Search

Find a vulnerability

Search criteria

    467 vulnerabilities

    CVE-2026-99288 (GCVE-0-2026-99288)

    Vulnerability from cvelistv5 – Published: 2026-11-10 18:19 – Updated: 2026-11-10 18:19
    VLAI
    Title
    inet: reject unhashed sockets during established lookups
    Summary
    In the Linux kernel, the following vulnerability has been resolved: inet: reject unhashed sockets during established lookups TCP established ehash lookups are lockless. The socket caches involved use SLAB_TYPESAFE_BY_RCU, so memory can be reused before an RCU reader that retained its old address has finished. After a tuple match, __inet_lookup_established() and __inet6_lookup_established() acquire a reference and repeat the tuple check. They do not check whether the new object is hashed. If the address is reused for a socket with the same tuple, the lookup can acquire a reference to the new object and return it while its nulls node is unhashed. A PoC that drives reuse with a SYN cookie request socket reproduced the crash. The new request socket is unhashed and has a NULL rsk_listener. A lookup that had loaded the address of the old request socket acquired the reference published by tcp_get_cookie_sock() and returned the new object. tcp_v4_rcv() then read sk_state through the NULL listener. The resulting crash was: BUG: kernel NULL pointer dereference, address: 0000000000000012 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page ... Oops: Oops: 0000 [#1] SMP NOPTI CPU: 4 UID: 0 PID: 0 Comm: swapper/4 Not tainted 7.3.0-00591-g0e135910deec #1 PREEMPT(lazy) ... RIP: 0010:tcp_v4_rcv+0x44e/0x1280 ... R10: 0000000000000001 R11: 00000000024ca8c0 R12: 0000000000000000 ... CR2: 0000000000000012 CR3: 0000000103d50004 CR4: 0000000000770ef0 ... Call Trace: <IRQ> ? raw_local_deliver+0xae/0x240 ip_protocol_deliver_rcu+0x2d/0x180 ip_local_deliver_finish+0x84/0x100 ip_sublist_rcv_finish+0x5f/0x70 ip_sublist_rcv+0x12a/0x1d0 ip_list_rcv+0xfd/0x130 __netif_receive_skb_list_core+0x223/0x250 netif_receive_skb_list_internal+0x1d2/0x2c0 ? try_fill_recv+0x39/0x7b0 napi_complete_done+0x74/0x170 virtnet_poll+0x445/0x600 __napi_poll+0x27/0x1e0 net_rx_action+0x2fe/0x3b0 handle_softirqs+0xc2/0x2c0 __irq_exit_rcu+0x74/0xd0 common_interrupt+0x7f/0x90 </IRQ> ... Kernel panic - not syncing: Fatal exception in interrupt After taking a reference, check whether the nulls node is unhashed in both IPv4 and IPv6 established lookups. If it is unhashed or the tuple no longer matches, drop the reference and restart the lookup. Lookups racing with the TIME_WAIT hashdance, or with a request being replaced by its child, now restart and find the new socket instead of returning the old one. Request sockets that were never inserted into ehash can have a nonzero refcount, and a stale lookup can hold a transient reference. Therefore, when SYN cookie, Fast Open, and request migration paths fail after setting a nonzero refcount, release the references held by those paths with reqsk_put() instead of freeing the request directly.
    Severity
    No CVSS data available.
    Assigner
    Linux CNA
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 079096f103faca2dd87342cca6f23d4b34da8871 , < d69100340b4cae08d40f898f1b601032403f6be6 (git)
    Affected: 079096f103faca2dd87342cca6f23d4b34da8871 , < 8e5172cbd227fae32f3313cba1f3e1b9edb5c4fd (git)
    Affected: 079096f103faca2dd87342cca6f23d4b34da8871 , < eb8a2d156f2c1d862fffdfd1b3432bfbcd939879 (git)
    		Create a notification for this product.
    Linux Linux Affected: 4.4
    Unaffected: 0 , < 4.4 (semver)
    Unaffected: 6.12.117 , ≤ 6.12.* (semver)
    Unaffected: 6.18.63 , ≤ 6.18.* (semver)
    Unaffected: 7.3.4 , ≤ 7.3.* (semver)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/inet_connection_sock.c",
            "net/ipv4/inet_hashtables.c",
            "net/ipv4/syncookies.c",
            "net/ipv4/tcp_input.c",
            "net/ipv6/inet6_hashtables.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d69100340b4cae08d40f898f1b601032403f6be6",
              "status": "affected",
              "version": "079096f103faca2dd87342cca6f23d4b34da8871",
              "versionType": "git"
            },
            {
              "lessThan": "8e5172cbd227fae32f3313cba1f3e1b9edb5c4fd",
              "status": "affected",
              "version": "079096f103faca2dd87342cca6f23d4b34da8871",
              "versionType": "git"
            },
            {
              "lessThan": "eb8a2d156f2c1d862fffdfd1b3432bfbcd939879",
              "status": "affected",
              "version": "079096f103faca2dd87342cca6f23d4b34da8871",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/inet_connection_sock.c",
            "net/ipv4/inet_hashtables.c",
            "net/ipv4/syncookies.c",
            "net/ipv4/tcp_input.c",
            "net/ipv6/inet6_hashtables.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.4"
            },
            {
              "lessThan": "4.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.63",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.3.*",
              "status": "unaffected",
              "version": "7.3.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.117",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.63",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3.4",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ninet: reject unhashed sockets during established lookups\n\nTCP established ehash lookups are lockless. The socket caches involved\nuse SLAB_TYPESAFE_BY_RCU, so memory can be reused before an RCU reader\nthat retained its old address has finished.\n\nAfter a tuple match, __inet_lookup_established() and\n__inet6_lookup_established() acquire a reference and repeat the tuple\ncheck. They do not check whether the new object is hashed. If the\naddress is reused for a socket with the same tuple, the lookup can\nacquire a reference to the new object and return it while its nulls node\nis unhashed.\n\nA PoC that drives reuse with a SYN cookie request socket reproduced the\ncrash. The new request socket is unhashed and has a NULL rsk_listener.\nA lookup that had loaded the address of the old request socket acquired\nthe reference published by tcp_get_cookie_sock() and returned the new\nobject. tcp_v4_rcv() then read sk_state through the NULL listener.\n\nThe resulting crash was:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000012\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  ...\n  Oops: Oops: 0000 [#1] SMP NOPTI\n  CPU: 4 UID: 0 PID: 0 Comm: swapper/4 Not tainted 7.3.0-00591-g0e135910deec #1 PREEMPT(lazy)\n  ...\n  RIP: 0010:tcp_v4_rcv+0x44e/0x1280\n  ...\n  R10: 0000000000000001 R11: 00000000024ca8c0 R12: 0000000000000000\n  ...\n  CR2: 0000000000000012 CR3: 0000000103d50004 CR4: 0000000000770ef0\n  ...\n  Call Trace:\n   \u003cIRQ\u003e\n   ? raw_local_deliver+0xae/0x240\n   ip_protocol_deliver_rcu+0x2d/0x180\n   ip_local_deliver_finish+0x84/0x100\n   ip_sublist_rcv_finish+0x5f/0x70\n   ip_sublist_rcv+0x12a/0x1d0\n   ip_list_rcv+0xfd/0x130\n   __netif_receive_skb_list_core+0x223/0x250\n   netif_receive_skb_list_internal+0x1d2/0x2c0\n   ? try_fill_recv+0x39/0x7b0\n   napi_complete_done+0x74/0x170\n   virtnet_poll+0x445/0x600\n   __napi_poll+0x27/0x1e0\n   net_rx_action+0x2fe/0x3b0\n   handle_softirqs+0xc2/0x2c0\n   __irq_exit_rcu+0x74/0xd0\n   common_interrupt+0x7f/0x90\n   \u003c/IRQ\u003e\n  ...\n  Kernel panic - not syncing: Fatal exception in interrupt\n\nAfter taking a reference, check whether the nulls node is unhashed in\nboth IPv4 and IPv6 established lookups. If it is unhashed or the tuple\nno longer matches, drop the reference and restart the lookup.\n\nLookups racing with the TIME_WAIT hashdance, or with a request being\nreplaced by its child, now restart and find the new socket instead of\nreturning the old one.\n\nRequest sockets that were never inserted into ehash can have a nonzero\nrefcount, and a stale lookup can hold a transient reference. Therefore,\nwhen SYN cookie, Fast Open, and request migration paths fail after\nsetting a nonzero refcount, release the references held by those paths\nwith reqsk_put() instead of freeing the request directly."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:19:08.557Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d69100340b4cae08d40f898f1b601032403f6be6"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e5172cbd227fae32f3313cba1f3e1b9edb5c4fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb8a2d156f2c1d862fffdfd1b3432bfbcd939879"
        }
      ],
      "title": "inet: reject unhashed sockets during established lookups",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99288",
    "datePublished": "2026-11-10T18:19:08.557Z",
    "dateReserved": "2026-09-25T10:25:14.405Z",
    "dateUpdated": "2026-11-10T18:19:08.557Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-99287 (GCVE-0-2026-99287)

    Vulnerability from cvelistv5 – Published: 2026-11-10 18:16 – Updated: 2026-11-10 21:05
    VLAI
    Title
    xen-netback: Zero out sring pointers on unmap
    Summary
    In the Linux kernel, the following vulnerability has been resolved: xen-netback: Zero out sring pointers on unmap If xenvif_map_frontend_data_rings() fails when a ring is already mapped, it unmaps them via xenvif_unmap_frontend_data_rings() which keeps the ring pointers unchanged. xenvif_connect_data()'s cleanup path calls xenvif_disconnect_queue() which in turn calls xenvif_unmap_frontend_data_rings() again, which will attempt to unmap the pointers a second time. Zero out the ring pointers after they are unmapped to avoid this issue. This is XSA-532
    Severity
    No CVSS data available.
    Assigner
    Linux CNA
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 2ac061ce97f413bfbbdd768f7d2e0fda2e8170df , < 87fd475dc4e354088f6534285388e7b061f54b35 (git)
    Affected: 2ac061ce97f413bfbbdd768f7d2e0fda2e8170df , < c5f54af611ff6fe1d53fa05d8e87b469dc56122b (git)
    Affected: 2ac061ce97f413bfbbdd768f7d2e0fda2e8170df , < e7ba61734d6ad6adfd5bf617052e590743211669 (git)
    		Create a notification for this product.
    Linux Linux Affected: 5.5
    Unaffected: 0 , < 5.5 (semver)
    Unaffected: 6.12.117 , ≤ 6.12.* (semver)
    Unaffected: 6.18.63 , ≤ 6.18.* (semver)
    Unaffected: 7.3.4 , ≤ 7.3.* (semver)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-11-10T21:05:27.340Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/11/10/26"
          },
          {
            "url": "http://xenbits.xen.org/xsa/advisory-532.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/xen-netback/netback.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "87fd475dc4e354088f6534285388e7b061f54b35",
              "status": "affected",
              "version": "2ac061ce97f413bfbbdd768f7d2e0fda2e8170df",
              "versionType": "git"
            },
            {
              "lessThan": "c5f54af611ff6fe1d53fa05d8e87b469dc56122b",
              "status": "affected",
              "version": "2ac061ce97f413bfbbdd768f7d2e0fda2e8170df",
              "versionType": "git"
            },
            {
              "lessThan": "e7ba61734d6ad6adfd5bf617052e590743211669",
              "status": "affected",
              "version": "2ac061ce97f413bfbbdd768f7d2e0fda2e8170df",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/xen-netback/netback.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.63",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.3.*",
              "status": "unaffected",
              "version": "7.3.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.117",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.63",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3.4",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netback: Zero out sring pointers on unmap\n\nIf xenvif_map_frontend_data_rings() fails when a ring is already mapped,\nit unmaps them via xenvif_unmap_frontend_data_rings() which keeps the\nring pointers unchanged. xenvif_connect_data()\u0027s cleanup path calls\nxenvif_disconnect_queue() which in turn calls\nxenvif_unmap_frontend_data_rings() again, which will attempt to unmap the\npointers a second time.\n\nZero out the ring pointers after they are unmapped to avoid this issue.\n\nThis is XSA-532"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:16:54.253Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/87fd475dc4e354088f6534285388e7b061f54b35"
        },
        {
          "url": "https://git.kernel.org/stable/c/c5f54af611ff6fe1d53fa05d8e87b469dc56122b"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7ba61734d6ad6adfd5bf617052e590743211669"
        }
      ],
      "title": "xen-netback: Zero out sring pointers on unmap",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99287",
    "datePublished": "2026-11-10T18:16:54.253Z",
    "dateReserved": "2026-09-25T10:25:14.405Z",
    "dateUpdated": "2026-11-10T21:05:27.340Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-99286 (GCVE-0-2026-99286)

    Vulnerability from cvelistv5 – Published: 2026-11-10 18:16 – Updated: 2026-11-10 21:05
    VLAI
    Title
    xen-netback: Fix XenBus connection failure cleanup
    Summary
    In the Linux kernel, the following vulnerability has been resolved: xen-netback: Fix XenBus connection failure cleanup xenvif_get_stats and xenvif_get_ethtool_stats capture vif->num_queues under rcu_read_lock. We need to unpublish vif->num_queues before synchronize_net to ensure that readers that come afterwards will not read a non-zero vif->num_queues and attempt to access invalid queues. This is the same cleanup algorithm as used in backend_disconnect and added in commit b17075d5c198 ("xen-netback: fix race condition on XenBus disconnect"). This is XSA-531
    Severity
    No CVSS data available.
    Assigner
    Linux CNA
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < ade3082dcdee17c5767069883936d64ff83f6c9f (git)
    Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a97aa838903d15f865d80809f5198ff459c6634a (git)
    Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 07aca7d25ce8578fedde49855983a01c537a782b (git)
    Affected: 0 , < 6.12.117 (semver)
    Affected: 0 , < 6.18.63 (semver)
    Affected: 0 , < 7.3.4 (semver)
    		Create a notification for this product.
    Linux Linux Unaffected: 6.12.117 , ≤ 6.12.* (semver)
    Unaffected: 6.18.63 , ≤ 6.18.* (semver)
    Unaffected: 7.3.4 , ≤ 7.3.* (semver)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-11-10T21:05:24.916Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/11/10/25"
          },
          {
            "url": "http://xenbits.xen.org/xsa/advisory-531.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/xen-netback/xenbus.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ade3082dcdee17c5767069883936d64ff83f6c9f",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "a97aa838903d15f865d80809f5198ff459c6634a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "07aca7d25ce8578fedde49855983a01c537a782b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.117",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.63",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.3.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/xen-netback/xenbus.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.63",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.3.*",
              "status": "unaffected",
              "version": "7.3.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.117",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.63",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netback: Fix XenBus connection failure cleanup\n\nxenvif_get_stats and xenvif_get_ethtool_stats capture vif-\u003enum_queues\nunder rcu_read_lock. We need to unpublish vif-\u003enum_queues before\nsynchronize_net to ensure that readers that come afterwards will not\nread a non-zero vif-\u003enum_queues and attempt to access invalid queues.\n\nThis is the same cleanup algorithm as used in backend_disconnect and\nadded in commit b17075d5c198 (\"xen-netback: fix race condition on XenBus\ndisconnect\").\n\nThis is XSA-531"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:16:53.997Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ade3082dcdee17c5767069883936d64ff83f6c9f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a97aa838903d15f865d80809f5198ff459c6634a"
        },
        {
          "url": "https://git.kernel.org/stable/c/07aca7d25ce8578fedde49855983a01c537a782b"
        }
      ],
      "title": "xen-netback: Fix XenBus connection failure cleanup",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99286",
    "datePublished": "2026-11-10T18:16:53.997Z",
    "dateReserved": "2026-09-25T10:25:14.405Z",
    "dateUpdated": "2026-11-10T21:05:24.916Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-99285 (GCVE-0-2026-99285)

    Vulnerability from cvelistv5 – Published: 2026-11-10 17:37 – Updated: 2026-11-10 17:37
    VLAI
    Title
    netfilter: nft_byteorder: remove multi-register support
    Summary
    In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_byteorder: remove multi-register support 64bit byteorder conversion is broken when several registers need to be converted because the source register array advances in steps for 4 bytes instead of 8: for (i = ... src64 = nft_reg_load64(&src[i]); ~~~~~ u32 *src nft_reg_store64(&dst64[i], Remove the multi-register support, it has other issues as well: Pablo points out that commit caf3ef7468f7 ("netfilter: nf_tables: prevent OOB access in nft_byteorder_eval") alters semantics: before the loop operated on registers, i.e. for ( ... ) dst32[i] = htons((u16)src32[i]) .. but after the patch it will operate on bytes, which makes this useless to convert e.g. concatenations, which store each compound in its own register. Multi-convert of u32 has one theoretical application: ct mark . meta mark . tcp dport @intervalset Because ct mark and meta mark are host byte order, use with intervals has to convert the byteorder for ct/meta mark value to network byte order (bigendian). nftables emits this: [ meta load mark => reg 1 ] [ byteorder reg 1 = hton(reg 1, 4, 4) ] [ ct load mark => reg 9 ] [ byteorder reg 9 = hton(reg 9, 4, 4) ] ... I.e. two separate calls. Theoretically it could be changed to do: [ meta load mark => reg 1 ] [ ct load mark => reg 9 ] [ byteorder reg 1 = htonl(reg 1, 4, 8) ] ... But then all it would take to change the set to meta mark . tcp dport . ct mark ... and we'd be back to two "byteorder" calls. IOW, support to convert a range of registers is both dysfunctional and dubious. Simplify this: remove the feature. Pablo Neira Ayuso points out that nftables before 1.1.0 can generate incorrect byteorder conversions, see 9fe58952c45a, "evaluate: skip byteorder conversion for selector smaller than 2 bytes" in nftables.git). Affected rulesets fail to load with this change and old userspace due to 'len != size' check.
    Severity
    No CVSS data available.
    Assigner
    Linux CNA
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63 , < 3c5fb3a6c8118d15e60295e76fb5b879021eef43 (git)
    Affected: c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63 , < dc29c0478b8564feb9371e715b5a0016eb8903fd (git)
    Affected: c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63 , < bb061d3de41707415269be75ebf700efb03ec212 (git)
    Affected: fca41e5b687e029f69e3a35a2fa31e2560e538dc (git)
    Affected: 25b42be4e067e107a2559266b54bf07fa5b094fb (git)
    Affected: 9a865a11d6890d4a789db1eaafebdc8bd092b12c (git)
    Affected: b8b514b2a6cdfac24911e4910461bcb9db15ca8d (git)
    Affected: 18a169810cff769a7a697b35058c756805f589e0 (git)
    Affected: 1a605657adc58b3c8e2c1c66aaa5fecd29072135 (git)
    Affected: 013deed31ab15ef287b0045e4e7bd8f250e75b94 (git)
    Affected: 4.19.307 , < 4.20 (semver)
    Affected: 5.4.269 , < 5.5 (semver)
    Affected: 5.10.210 , < 5.11 (semver)
    Affected: 5.15.140 , < 5.16 (semver)
    Affected: 6.1.64 , < 6.2 (semver)
    Affected: 6.5.13 , < 6.6 (semver)
    Affected: 6.6.3 , < 6.7 (semver)
    		Create a notification for this product.
    Linux Linux Affected: 6.7
    Unaffected: 0 , < 6.7 (semver)
    Unaffected: 6.12.115 , ≤ 6.12.* (semver)
    Unaffected: 6.18.59 , ≤ 6.18.* (semver)
    Unaffected: 7.1 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_byteorder.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3c5fb3a6c8118d15e60295e76fb5b879021eef43",
              "status": "affected",
              "version": "c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63",
              "versionType": "git"
            },
            {
              "lessThan": "dc29c0478b8564feb9371e715b5a0016eb8903fd",
              "status": "affected",
              "version": "c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63",
              "versionType": "git"
            },
            {
              "lessThan": "bb061d3de41707415269be75ebf700efb03ec212",
              "status": "affected",
              "version": "c301f0981fdd3fd1ffac6836b423c4d7a8e0eb63",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "fca41e5b687e029f69e3a35a2fa31e2560e538dc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "25b42be4e067e107a2559266b54bf07fa5b094fb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9a865a11d6890d4a789db1eaafebdc8bd092b12c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b8b514b2a6cdfac24911e4910461bcb9db15ca8d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "18a169810cff769a7a697b35058c756805f589e0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1a605657adc58b3c8e2c1c66aaa5fecd29072135",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "013deed31ab15ef287b0045e4e7bd8f250e75b94",
              "versionType": "git"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.307",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.269",
              "versionType": "semver"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.210",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.140",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.64",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6",
              "status": "affected",
              "version": "6.5.13",
              "versionType": "semver"
            },
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.6.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_byteorder.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.115",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.115",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.59",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.307",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.269",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.210",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.140",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.64",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_byteorder: remove multi-register support\n\n64bit byteorder conversion is broken when several registers need to be\nconverted because the source register array advances in steps for 4 bytes\ninstead of 8:\n\n  for (i = ...\n      src64 = nft_reg_load64(\u0026src[i]);\n                             ~~~~~ u32 *src\n      nft_reg_store64(\u0026dst64[i],\n\nRemove the multi-register support, it has other issues as well:\n\nPablo points out that commit\ncaf3ef7468f7 (\"netfilter: nf_tables: prevent OOB access in nft_byteorder_eval\")\nalters semantics: before the loop operated on registers, i.e.\n for ( ... )\n   dst32[i] = htons((u16)src32[i])\n\n .. but after the patch it will operate on bytes, which makes this\n useless to convert e.g. concatenations, which store each compound\n in its own register.\n\nMulti-convert of u32 has one theoretical application:\n\nct mark . meta mark . tcp dport @intervalset\n\nBecause ct mark and meta mark are host byte order, use with\nintervals has to convert the byteorder for ct/meta mark value\nto network byte order (bigendian).\n\nnftables emits this:\n [ meta load mark =\u003e reg 1 ]\n [ byteorder reg 1 = hton(reg 1, 4, 4) ]\n [ ct load mark =\u003e reg 9 ]\n [ byteorder reg 9 = hton(reg 9, 4, 4) ]\n ...\n\nI.e. two separate calls.  Theoretically it could be changed to do:\n [ meta load mark =\u003e reg 1 ]\n [ ct load mark =\u003e reg 9 ]\n [ byteorder reg 1 = htonl(reg 1, 4, 8) ]\n ...\n\nBut then all it would take to change the set to\nmeta mark . tcp dport . ct mark\n\n... and we\u0027d be back to two \"byteorder\" calls. IOW, support to\nconvert a range of registers is both dysfunctional and dubious.\n\nSimplify this: remove the feature.\n\nPablo Neira Ayuso points out that nftables before 1.1.0 can generate\nincorrect byteorder conversions, see 9fe58952c45a,\n\"evaluate: skip byteorder conversion for selector smaller than 2 bytes\"\nin nftables.git).  Affected rulesets fail to load with this change and\nold userspace due to \u0027len != size\u0027 check."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T17:37:13.348Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3c5fb3a6c8118d15e60295e76fb5b879021eef43"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc29c0478b8564feb9371e715b5a0016eb8903fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb061d3de41707415269be75ebf700efb03ec212"
        }
      ],
      "title": "netfilter: nft_byteorder: remove multi-register support",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99285",
    "datePublished": "2026-11-10T17:37:13.348Z",
    "dateReserved": "2026-09-25T10:25:14.405Z",
    "dateUpdated": "2026-11-10T17:37:13.348Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-99284 (GCVE-0-2026-99284)

    Vulnerability from cvelistv5 – Published: 2026-11-07 20:40 – Updated: 2026-11-10 18:15
    VLAI
    Title
    net: skbuff: propagate shared-frag marker in skb_zerocopy()
    Summary
    In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker in skb_zerocopy() skb_zerocopy() moves frag descriptors from @from into @to and takes a reference on each frag, but it does not copy skb_shinfo(from)->flags into skb_shinfo(to)->flags. A destination skb holding the same page-cache backed frags as the source therefore reports skb_has_shared_frag() as false. That breaks the invariant relied on by later in-place writers. ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(); with the marker lost, an skb that skb_zerocopy() built for nfnetlink_queue or for an openvswitch upcall is decrypted in place, letting an unprivileged user write into the page cache of a root-owned read-only file. Propagate SKBFL_SHARED_FRAG when frag descriptors are copied, as done for the other frag-transfer helpers.
    Severity
    No CVSS data available.
    Assigner
    Linux CNA
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: af2806f8f90a150160be898cd85332459c83c5cb , < fe8477e23dd2ee6bce231d65f2586a333b211dc0 (git)
    Affected: af2806f8f90a150160be898cd85332459c83c5cb , < 1c623e3cbf43f12dd4a72712079bfa247a9b8ba3 (git)
    Affected: af2806f8f90a150160be898cd85332459c83c5cb , < d7d6ff98d5d1b400f02211f962ac32cc0020aeab (git)
    Affected: af2806f8f90a150160be898cd85332459c83c5cb , < 1a9c180cd8435917b7516edfb1c9148032c28773 (git)
    Affected: af2806f8f90a150160be898cd85332459c83c5cb , < 79dc34beb1fdb3da79753e51e15c68591a2561fe (git)
    		Create a notification for this product.
    Linux Linux Affected: 3.14
    Unaffected: 0 , < 3.14 (semver)
    Unaffected: 6.12.117 , ≤ 6.12.* (semver)
    Unaffected: 6.18.61 , ≤ 6.18.* (semver)
    Unaffected: 7.2.15 , ≤ 7.2.* (semver)
    Unaffected: 7.3.2 , ≤ 7.3.* (semver)
    Unaffected: 7.4-rc1 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/skbuff.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fe8477e23dd2ee6bce231d65f2586a333b211dc0",
              "status": "affected",
              "version": "af2806f8f90a150160be898cd85332459c83c5cb",
              "versionType": "git"
            },
            {
              "lessThan": "1c623e3cbf43f12dd4a72712079bfa247a9b8ba3",
              "status": "affected",
              "version": "af2806f8f90a150160be898cd85332459c83c5cb",
              "versionType": "git"
            },
            {
              "lessThan": "d7d6ff98d5d1b400f02211f962ac32cc0020aeab",
              "status": "affected",
              "version": "af2806f8f90a150160be898cd85332459c83c5cb",
              "versionType": "git"
            },
            {
              "lessThan": "1a9c180cd8435917b7516edfb1c9148032c28773",
              "status": "affected",
              "version": "af2806f8f90a150160be898cd85332459c83c5cb",
              "versionType": "git"
            },
            {
              "lessThan": "79dc34beb1fdb3da79753e51e15c68591a2561fe",
              "status": "affected",
              "version": "af2806f8f90a150160be898cd85332459c83c5cb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/skbuff.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.14"
            },
            {
              "lessThan": "3.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.3.*",
              "status": "unaffected",
              "version": "7.3.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.4-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.117",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.61",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.15",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3.2",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.4-rc1",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: propagate shared-frag marker in skb_zerocopy()\n\nskb_zerocopy() moves frag descriptors from @from into @to and takes a\nreference on each frag, but it does not copy skb_shinfo(from)-\u003eflags into\nskb_shinfo(to)-\u003eflags.  A destination skb holding the same page-cache\nbacked frags as the source therefore reports skb_has_shared_frag() as\nfalse.\n\nThat breaks the invariant relied on by later in-place writers.  ESP input\nchecks skb_has_shared_frag() before deciding whether an uncloned\nnonlinear skb can skip skb_cow_data(); with the marker lost, an skb that\nskb_zerocopy() built for nfnetlink_queue or for an openvswitch upcall is\ndecrypted in place, letting an unprivileged user write into the page\ncache of a root-owned read-only file.\n\nPropagate SKBFL_SHARED_FRAG when frag descriptors are copied, as done for\nthe other frag-transfer helpers."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:15:30.724Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fe8477e23dd2ee6bce231d65f2586a333b211dc0"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c623e3cbf43f12dd4a72712079bfa247a9b8ba3"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7d6ff98d5d1b400f02211f962ac32cc0020aeab"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a9c180cd8435917b7516edfb1c9148032c28773"
        },
        {
          "url": "https://git.kernel.org/stable/c/79dc34beb1fdb3da79753e51e15c68591a2561fe"
        }
      ],
      "title": "net: skbuff: propagate shared-frag marker in skb_zerocopy()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99284",
    "datePublished": "2026-11-07T20:40:33.661Z",
    "dateReserved": "2026-09-25T10:25:14.405Z",
    "dateUpdated": "2026-11-10T18:15:30.724Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-99283 (GCVE-0-2026-99283)

    Vulnerability from cvelistv5 – Published: 2026-11-07 20:14 – Updated: 2026-11-10 18:15
    VLAI
    Title
    netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
    Summary
    In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets Commit be0502a3f2e9 ("netfilter: conntrack: tcp: only close if RST matches exact sequence") keeps an established conntrack entry in ESTABLISHED when an in-window RST does not match the expected sequence number exactly, so the endpoint can validate the RST with a challenge ACK. The timeout selection nevertheless uses the CLOSE timeout for every RST packet. The bug is that timeout selection is based on the packet type, not on the state transition result: even when RST validation keeps new_state in ESTABLISHED, the timeout is still forced to TCP_CONNTRACK_CLOSE. Linux TCP independently rate limits challenge ACKs per socket. A second non-exact RST can therefore arrive after the first challenge ACK has restored the timeout but before the rate limit expires. The second RST lowers the timeout to 10 seconds again while the endpoint suppresses the second challenge ACK, allowing the conntrack entry to expire while both TCP endpoints remain established. Using the ESTABLISHED timeout for such RSTs would avoid this short expiration window, but it could also retain stale entries for the five-day default because conntrack cannot reliably match the endpoint's exact TCP state. Use the UNACK timeout for RST packets that leave the conntrack entry in TCP_CONNTRACK_ESTABLISHED. Exact-match RSTs and accepted RST packet trains still fall through to timeouts[new_state], which preserves the CLOSE timeout when conntrack accepts the RST as closing the flow. This avoids the aggressive 10-second expiration window for non-exact RSTs while preserving the short timeout for RSTs that conntrack accepts as closing the flow.
    Severity
    No CVSS data available.
    Assigner
    Linux CNA
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 4d39a039d0b7737f8475c2431f18572b3b186a3b (git)
    Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 0c6d33329960b2d884a399196c8403643d8a9de6 (git)
    Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < bf80e6802273a900311b44e47c9b1a59c6d2473c (git)
    Affected: 0 , < 6.12.117 (semver)
    Affected: 0 , < 6.18.61 (semver)
    		Create a notification for this product.
    Linux Linux Unaffected: 6.12.117 , ≤ 6.12.* (semver)
    Unaffected: 6.18.61 , ≤ 6.18.* (semver)
    Unaffected: 7.3 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_conntrack_proto_tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4d39a039d0b7737f8475c2431f18572b3b186a3b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "0c6d33329960b2d884a399196c8403643d8a9de6",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "bf80e6802273a900311b44e47c9b1a59c6d2473c",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.117",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.61",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_conntrack_proto_tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.117",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.61",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets\n\nCommit be0502a3f2e9 (\"netfilter: conntrack: tcp: only close if RST\nmatches exact sequence\") keeps an established conntrack entry in\nESTABLISHED when an in-window RST does not match the expected sequence\nnumber exactly, so the endpoint can validate the RST with a challenge\nACK.\n\nThe timeout selection nevertheless uses the CLOSE timeout for every RST\npacket.  The bug is that timeout selection is based on the packet type,\nnot on the state transition result: even when RST validation keeps\nnew_state in ESTABLISHED, the timeout is still forced to\nTCP_CONNTRACK_CLOSE.\n\nLinux TCP independently rate limits challenge ACKs per socket.  A second\nnon-exact RST can therefore arrive after the first challenge ACK has\nrestored the timeout but before the rate limit expires.  The second RST\nlowers the timeout to 10 seconds again while the endpoint suppresses the\nsecond challenge ACK, allowing the conntrack entry to expire while both\nTCP endpoints remain established.\n\nUsing the ESTABLISHED timeout for such RSTs would avoid this short\nexpiration window, but it could also retain stale entries for the\nfive-day default because conntrack cannot reliably match the endpoint\u0027s\nexact TCP state.\n\nUse the UNACK timeout for RST packets that leave the conntrack entry in\nTCP_CONNTRACK_ESTABLISHED.  Exact-match RSTs and accepted RST packet\ntrains still fall through to timeouts[new_state], which preserves the\nCLOSE timeout when conntrack accepts the RST as closing the flow.\n\nThis avoids the aggressive 10-second expiration window for non-exact\nRSTs while preserving the short timeout for RSTs that conntrack accepts\nas closing the flow."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:15:30.084Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4d39a039d0b7737f8475c2431f18572b3b186a3b"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c6d33329960b2d884a399196c8403643d8a9de6"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf80e6802273a900311b44e47c9b1a59c6d2473c"
        }
      ],
      "title": "netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99283",
    "datePublished": "2026-11-07T20:14:11.433Z",
    "dateReserved": "2026-09-25T10:25:14.405Z",
    "dateUpdated": "2026-11-10T18:15:30.084Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-99282 (GCVE-0-2026-99282)

    Vulnerability from cvelistv5 – Published: 2026-11-07 14:08 – Updated: 2026-11-10 18:15
    VLAI
    Title
    net/sched: sch_teql: fix use-after-free on lower qdisc drop
    Summary
    In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_teql: fix use-after-free on lower qdisc drop The issue: teql_master_xmit() tests the slave's ndo_start_xmit() return value against NETDEV_TX_OK alone. A slave that consumes the skb but returns an error code (rc < NET_XMIT_MASK, e.g. NET_XMIT_DROP) is treated as if the skb were still owned, so the loop restores skb->dev and calls __skb_pull() on it. A VLAN slave returns the result of dev_queue_xmit() from its ndo_start_xmit() (propagated since cbbef5e18307), and when the lower qdisc drops the packet that value is NET_XMIT_DROP after the skb has been freed, giving a use-after-free in teql_master_xmit(). The Fix: test for consumption with dev_xmit_complete(), which accepts NETDEV_TX_OK and every rc < NET_XMIT_MASK, matching other callers that need to distinguish consumed results from busy. Only NETDEV_TX_OK keeps the packet counted in tx_packets/tx_bytes and advances the slave; a consumed result that is neither a success nor NET_XMIT_CN ends the attempt and is charged to tx_dropped, so lower-qdisc drops are no longer reported as good transmits. NET_XMIT_CN is counted like success because it can accompany acceptance of the current packet: pfifo_head_drop drops the old head, enqueues the current skb and returns NET_XMIT_CN. Conditions to recreate the bug: With CONFIG_NET_SCH_TEQL, CONFIG_VLAN_8021Q and CONFIG_DUMMY enabled, add lkrdummy0 (dummy) and lkrvlan0 (VLAN id 37 on lkrdummy0); set a pfifo limit 0 root on lkrdummy0 and a teql0 root on lkrvlan0; bring teql0 up with an address and send one UDP packet to it. The VLAN xmit returns NET_XMIT_DROP from the lower qdisc while holding a freed skb.
    Severity
    No CVSS data available.
    Assigner
    Linux CNA
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 572a9d7b6fc7f20f573664063324c086be310c42 , < 8d5f768780e26cb82c389219ae7fdb1cd7255421 (git)
    Affected: 572a9d7b6fc7f20f573664063324c086be310c42 , < fc55d92ae6a4b2e7d062cad6d4c67f6b061d9cde (git)
    Affected: 572a9d7b6fc7f20f573664063324c086be310c42 , < 2702ae318630787c640ec0d0403ffd9d95c43e9e (git)
    Affected: 572a9d7b6fc7f20f573664063324c086be310c42 , < 782d6bb8f9b8e9d8591181662222bf74cd3ecf79 (git)
    		Create a notification for this product.
    Linux Linux Affected: 2.6.33
    Unaffected: 0 , < 2.6.33 (semver)
    Unaffected: 6.12.117 , ≤ 6.12.* (semver)
    Unaffected: 6.18.61 , ≤ 6.18.* (semver)
    Unaffected: 7.3.2 , ≤ 7.3.* (semver)
    Unaffected: 7.4-rc1 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_teql.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8d5f768780e26cb82c389219ae7fdb1cd7255421",
              "status": "affected",
              "version": "572a9d7b6fc7f20f573664063324c086be310c42",
              "versionType": "git"
            },
            {
              "lessThan": "fc55d92ae6a4b2e7d062cad6d4c67f6b061d9cde",
              "status": "affected",
              "version": "572a9d7b6fc7f20f573664063324c086be310c42",
              "versionType": "git"
            },
            {
              "lessThan": "2702ae318630787c640ec0d0403ffd9d95c43e9e",
              "status": "affected",
              "version": "572a9d7b6fc7f20f573664063324c086be310c42",
              "versionType": "git"
            },
            {
              "lessThan": "782d6bb8f9b8e9d8591181662222bf74cd3ecf79",
              "status": "affected",
              "version": "572a9d7b6fc7f20f573664063324c086be310c42",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_teql.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.33"
            },
            {
              "lessThan": "2.6.33",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.3.*",
              "status": "unaffected",
              "version": "7.3.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.4-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.117",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.61",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3.2",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.4-rc1",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_teql: fix use-after-free on lower qdisc drop\n\nThe issue: teql_master_xmit() tests the slave\u0027s ndo_start_xmit() return\nvalue against NETDEV_TX_OK alone. A slave that consumes the skb but\nreturns an error code (rc \u003c NET_XMIT_MASK, e.g. NET_XMIT_DROP) is treated\nas if the skb were still owned, so the loop restores skb-\u003edev and calls\n__skb_pull() on it. A VLAN slave returns the result of dev_queue_xmit()\nfrom its ndo_start_xmit() (propagated since cbbef5e18307), and when the\nlower qdisc drops the packet that value is NET_XMIT_DROP after the skb\nhas been freed, giving a use-after-free in teql_master_xmit().\n\nThe Fix: test for consumption with dev_xmit_complete(), which accepts\nNETDEV_TX_OK and every rc \u003c NET_XMIT_MASK, matching other callers that\nneed to distinguish consumed results from busy. Only NETDEV_TX_OK keeps\nthe packet counted in tx_packets/tx_bytes and advances the slave; a\nconsumed result that is neither a success nor NET_XMIT_CN ends the\nattempt and is charged to tx_dropped, so lower-qdisc drops are no longer\nreported as good transmits. NET_XMIT_CN is counted like success because\nit can accompany acceptance of the current packet: pfifo_head_drop drops\nthe old head, enqueues the current skb and returns NET_XMIT_CN.\n\nConditions to recreate the bug:\nWith CONFIG_NET_SCH_TEQL,\nCONFIG_VLAN_8021Q and CONFIG_DUMMY enabled, add lkrdummy0 (dummy) and\nlkrvlan0 (VLAN id 37 on lkrdummy0); set a pfifo limit 0 root on lkrdummy0\nand a teql0 root on lkrvlan0; bring teql0 up with an address and send one\nUDP packet to it. The VLAN xmit returns NET_XMIT_DROP from the lower\nqdisc while holding a freed skb."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:15:29.554Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8d5f768780e26cb82c389219ae7fdb1cd7255421"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc55d92ae6a4b2e7d062cad6d4c67f6b061d9cde"
        },
        {
          "url": "https://git.kernel.org/stable/c/2702ae318630787c640ec0d0403ffd9d95c43e9e"
        },
        {
          "url": "https://git.kernel.org/stable/c/782d6bb8f9b8e9d8591181662222bf74cd3ecf79"
        }
      ],
      "title": "net/sched: sch_teql: fix use-after-free on lower qdisc drop",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99282",
    "datePublished": "2026-11-07T14:08:47.978Z",
    "dateReserved": "2026-09-25T10:25:14.405Z",
    "dateUpdated": "2026-11-10T18:15:29.554Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-99281 (GCVE-0-2026-99281)

    Vulnerability from cvelistv5 – Published: 2026-11-07 14:08 – Updated: 2026-11-10 18:15
    VLAI
    Title
    tun: Require CAP_NET_ADMIN to attach to an ownerless device
    Summary
    In the Linux kernel, the following vulnerability has been resolved: tun: Require CAP_NET_ADMIN to attach to an ownerless device Twenty years ago I made creating a tuntap device require CAP_NET_ADMIN in commit ca6bb5d7ab22 ("[NET]: Require CAP_NET_ADMIN to create tuntap devices.") The idea was to allow the permissions on /dev/net/tun to be relaxed to 0666 and thus allow owners of tun devices assigned with TUNSETOWNER to actually open it and get at their devices. What we missed at the time was that persistent devices with *no* owner were already essentially world-consumable, and anyone who could open the device node could also attach to those. Even then, using persistent devices with no explicitly set owner — on the (false) presumption that CAP_NET_ADMIN would be required to open them — wasn't an egregious userspace bug. There are cases where it does make sense to separate the creation/configuration of the netdevice, from the process which shovels packets into it. Since then, TUNSETGROUP was added a year later in commit 8c644623fe7e ("[NET]: Allow group ownership of TUN/TAP devices."). Its commit message noted that if both uid and gid are set, both have to match (in itself a bizarre choice) — but still not that with *neither* set, no permission at all was required. Then in 2012 commit c8d68e6be1c3 ("tuntap: multiqueue support") allowed new queues to be attached to a device from the moment of its creation, with no way for userspace to close the race between creation and a subsequent TUNSET{OWNER,GROUP}. In 2024, commit 3ca459eaba1bf ("tun: fix group permission check") tried to fix things to be saner: only require the user *or* the group to match, in line with standard POSIX permissions, and require CAP_NET_ADMIN if neither the user nor group authorised the access (although it put the CAP_NET_ADMIN check first, and would wrongly have reported the capability as having been used even when it was not). That fix was reverted in commit a70c7b3cbc06 ("tun: revert fix group permission check") due to allegedly causing a regression in an selinux test suite which *expected* the attachment to succeed when authorised by none of user, group, nor CAP_NET_ADMIN: https://lore.kernel.org/netdev/CAFqZXNtkCBT4f+PwyVRmQGoT3p1eVa01fCG_aNtpt6dakXncUg@mail.gmail.com/ We should not break UAPI. But we don't have to consider an selinux test case which deliberately exercises a security flaw to be UAPI worth preserving either. To which end, I have fixed it in selinux-testsuite commit b2f894f0016b ("tests/tun_tap: set an owner on the device for the relabel tests"). So: fix the lack of CAP_NET_ADMIN check on devices which *haven't* been assigned an owner or group, while leaving the weird tun ownership model as it was (user *and* group have to match, if both are set). If someone still wants to fix the latter (which wasn't actually the reason the previous attempt was reverted), they can do it under separate cover. Permit attaching to an existing device only if an owner and/or group was set and the caller matches all that were set, or if the caller has CAP_NET_ADMIN. The only behavioural change is that a device with no owner or group now requires CAP_NET_ADMIN to attach — precisely the loophole we want to close. And put the CAP_NET_ADMIN check in the right place this time.
    Severity
    7.8 (High)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    Assigner
    Linux CNA
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: ca6bb5d7ab22ac79f608fe6cbc6b12de6a5a19f0 , < e0d98aab41b79b88609f33fb4d8e7a80ab8f648d (git)
    Affected: ca6bb5d7ab22ac79f608fe6cbc6b12de6a5a19f0 , < 2f92c0286cfd58bff9d6d54c01a771073d5eb775 (git)
    Affected: ca6bb5d7ab22ac79f608fe6cbc6b12de6a5a19f0 , < e53d1cf05da8ea58a5743b7ce5894fb51b0b9700 (git)
    Affected: ca6bb5d7ab22ac79f608fe6cbc6b12de6a5a19f0 , < ffdf678dd16610e3f006dac904bd37c09684673c (git)
    		Create a notification for this product.
    Linux Linux Affected: 2.6.18
    Unaffected: 0 , < 2.6.18 (semver)
    Unaffected: 6.12.117 , ≤ 6.12.* (semver)
    Unaffected: 6.18.61 , ≤ 6.18.* (semver)
    Unaffected: 7.3.2 , ≤ 7.3.* (semver)
    Unaffected: 7.4-rc1 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/tun.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e0d98aab41b79b88609f33fb4d8e7a80ab8f648d",
              "status": "affected",
              "version": "ca6bb5d7ab22ac79f608fe6cbc6b12de6a5a19f0",
              "versionType": "git"
            },
            {
              "lessThan": "2f92c0286cfd58bff9d6d54c01a771073d5eb775",
              "status": "affected",
              "version": "ca6bb5d7ab22ac79f608fe6cbc6b12de6a5a19f0",
              "versionType": "git"
            },
            {
              "lessThan": "e53d1cf05da8ea58a5743b7ce5894fb51b0b9700",
              "status": "affected",
              "version": "ca6bb5d7ab22ac79f608fe6cbc6b12de6a5a19f0",
              "versionType": "git"
            },
            {
              "lessThan": "ffdf678dd16610e3f006dac904bd37c09684673c",
              "status": "affected",
              "version": "ca6bb5d7ab22ac79f608fe6cbc6b12de6a5a19f0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/tun.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.18"
            },
            {
              "lessThan": "2.6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.3.*",
              "status": "unaffected",
              "version": "7.3.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.4-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.117",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.61",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3.2",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.4-rc1",
                  "versionStartIncluding": "2.6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntun: Require CAP_NET_ADMIN to attach to an ownerless device\n\nTwenty years ago I made creating a tuntap device require CAP_NET_ADMIN\nin commit ca6bb5d7ab22 (\"[NET]: Require CAP_NET_ADMIN to create tuntap\ndevices.\")\n\nThe idea was to allow the permissions on /dev/net/tun to be relaxed to\n0666 and thus allow owners of tun devices assigned with TUNSETOWNER to\nactually open it and get at their devices.\n\nWhat we missed at the time was that persistent devices with *no* owner\nwere already essentially world-consumable, and anyone who could open\nthe device node could also attach to those.\n\nEven then, using persistent devices with no explicitly set owner \u2014 on\nthe (false) presumption that CAP_NET_ADMIN would be required to open\nthem \u2014 wasn\u0027t an egregious userspace bug. There are cases where it does\nmake sense to separate the creation/configuration of the netdevice, from\nthe process which shovels packets into it.\n\nSince then, TUNSETGROUP was added a year later in commit 8c644623fe7e\n(\"[NET]: Allow group ownership of TUN/TAP devices.\"). Its commit message\nnoted that if both uid and gid are set, both have to match (in itself a\nbizarre choice) \u2014 but still not that with *neither* set, no permission\nat all was required.\n\nThen in 2012 commit c8d68e6be1c3 (\"tuntap: multiqueue support\") allowed\nnew queues to be attached to a device from the moment of its creation,\nwith no way for userspace to close the race between creation and a\nsubsequent TUNSET{OWNER,GROUP}.\n\nIn 2024, commit 3ca459eaba1bf (\"tun: fix group permission check\") tried\nto fix things to be saner: only require the user *or* the group to\nmatch, in line with standard POSIX permissions, and require\nCAP_NET_ADMIN if neither the user nor group authorised the access\n(although it put the CAP_NET_ADMIN check first, and would wrongly have\nreported the capability as having been used even when it was not).\n\nThat fix was reverted in commit a70c7b3cbc06 (\"tun: revert fix group\npermission check\") due to allegedly causing a regression in an selinux\ntest suite which *expected* the attachment to succeed when authorised\nby none of user, group, nor CAP_NET_ADMIN:\nhttps://lore.kernel.org/netdev/CAFqZXNtkCBT4f+PwyVRmQGoT3p1eVa01fCG_aNtpt6dakXncUg@mail.gmail.com/\n\nWe should not break UAPI. But we don\u0027t have to consider an selinux test\ncase which deliberately exercises a security flaw to be UAPI worth\npreserving either. To which end, I have fixed it in selinux-testsuite\ncommit b2f894f0016b (\"tests/tun_tap: set an owner on the device for the\nrelabel tests\").\n\nSo: fix the lack of CAP_NET_ADMIN check on devices which *haven\u0027t* been\nassigned an owner or group, while leaving the weird tun ownership model\nas it was (user *and* group have to match, if both are set). If someone\nstill wants to fix the latter (which wasn\u0027t actually the reason the\nprevious attempt was reverted), they can do it under separate cover.\n\nPermit attaching to an existing device only if an owner and/or group was\nset and the caller matches all that were set, or if the caller has\nCAP_NET_ADMIN. The only behavioural change is that a device with no\nowner or group now requires CAP_NET_ADMIN to attach \u2014 precisely the\nloophole we want to close.\n\nAnd put the CAP_NET_ADMIN check in the right place this time."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker reaches the patched check by opening /dev/net/tun in tun_chr_open and issuing TUNSETIFF; __tun_chr_ioctl copies the ifreq and tun_set_iff looks the device up with __dev_get_by_name. The triggering input is that ioctl, on the ownerless branch of the old tun_not_capable predicate.\nAC:L - tun_setup stores INVALID_UID and INVALID_GID, so the old tun_not_capable predicate is false with no race. After the creator of an IFF_PERSIST device closes it, numqueues is 0 and tun_attach from TUNSETIFF succeeds on every try; an IFF_MULTI_QUEUE device accepts another queue the same way.\nPR:L - The ownerless path in the old tun_not_capable returns false without calling ns_capable(net-\u003euser_ns, CAP_NET_ADMIN). tun_chr_open has no capability check, and /dev/net/tun is mode 0666, so any local user can issue that TUNSETIFF. The caller is an unprivileged local user.\nUI:N - The attacker alone opens /dev/net/tun and passes the interface name to TUNSETIFF. That ioctl is the whole trigger.\nS:U - tun_chr_open binds the fd to current-\u003ensproxy-\u003enet_ns, and tun_set_iff attaches only a device in that net. The impact is that namespace\u0027s tun packet queue and the tun ioctls on the resulting fd, under the same security authority as the caller.\nC:H - tun_net_xmit queues the device\u0027s egress skbs on the attached tfile, and tun_chr_read_iter, tun_do_read, and tun_put_user copy each full skb to the attacker. On a single-queue device that is every packet the host transmits on that interface.\nI:H - tun_chr_write_iter calls tun_get_user, which copies the attacker buffer into an skb, sets skb-\u003edev, and injects it through netif_rx as ingress. On that same fd, __tun_chr_ioctl handles SIOCSIFHWADDR, TUNSETTXFILTER, TUNSETOWNER, and set_offload with no further capability check.\nA:H - Once numqueues is 1, a non-multiqueue tun_attach returns -EBUSY, so the legitimate opener cannot reclaim the device. TUNSETCARRIER calls netif_carrier_off, and TUNSETPERSIST(0) followed by close makes __tun_detach call unregister_netdevice and delete the interface."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:15:28.611Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e0d98aab41b79b88609f33fb4d8e7a80ab8f648d"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f92c0286cfd58bff9d6d54c01a771073d5eb775"
        },
        {
          "url": "https://git.kernel.org/stable/c/e53d1cf05da8ea58a5743b7ce5894fb51b0b9700"
        },
        {
          "url": "https://git.kernel.org/stable/c/ffdf678dd16610e3f006dac904bd37c09684673c"
        }
      ],
      "title": "tun: Require CAP_NET_ADMIN to attach to an ownerless device",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99281",
    "datePublished": "2026-11-07T14:08:47.735Z",
    "dateReserved": "2026-09-25T10:25:14.405Z",
    "dateUpdated": "2026-11-10T18:15:28.611Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-99277 (GCVE-0-2026-99277)

    Vulnerability from cvelistv5 – Published: 2026-11-07 14:08 – Updated: 2026-11-10 16:57
    VLAI
    Title
    ksmbd: hold a connection reference for each session channel
    Summary
    In the Linux kernel, the following vulnerability has been resolved: ksmbd: hold a connection reference for each session channel ksmbd_session_unregister() removes a session from the global and per- connection tables before dropping the table reference. A concurrent reference holder can keep the session and its channel list alive after those removals. Connection cleanup can no longer find the unpublished session to remove its channels. Since a channel only stores a raw conn pointer, the connection can be freed while another session reference holder is still accessing it, for example during SMB3.1.1 binding or a procfs read. Take a connection reference when registering a channel and release it on insertion failure, channel removal, or final session destruction. Keep the channels and signing keys until the session is destroyed so a response can still be signed after the session has been unregistered.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
    Assigner
    Linux CNA
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: d7fd1f98607f2cd358e583f9548bdf0173090a86 , < 4b333aed69cfc2c8687b86b6a4364a0dffc16dd8 (git)
    Affected: d7fd1f98607f2cd358e583f9548bdf0173090a86 , < add8d7fb04efe564193df73581889c62fc0016f1 (git)
    Affected: c99ea7855124ca1428a1e59c2b4590aaef34eacf (git)
    Affected: 7.2.8 , < 7.3 (semver)
    		Create a notification for this product.
    Linux Linux Affected: 7.3
    Unaffected: 0 , < 7.3 (semver)
    Unaffected: 7.3.2 , ≤ 7.3.* (semver)
    Unaffected: 7.4-rc1 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/mgmt/user_session.c",
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4b333aed69cfc2c8687b86b6a4364a0dffc16dd8",
              "status": "affected",
              "version": "d7fd1f98607f2cd358e583f9548bdf0173090a86",
              "versionType": "git"
            },
            {
              "lessThan": "add8d7fb04efe564193df73581889c62fc0016f1",
              "status": "affected",
              "version": "d7fd1f98607f2cd358e583f9548bdf0173090a86",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c99ea7855124ca1428a1e59c2b4590aaef34eacf",
              "versionType": "git"
            },
            {
              "lessThan": "7.3",
              "status": "affected",
              "version": "7.2.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/mgmt/user_session.c",
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.3"
            },
            {
              "lessThan": "7.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.3.*",
              "status": "unaffected",
              "version": "7.3.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.4-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3.2",
                  "versionStartIncluding": "7.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.4-rc1",
                  "versionStartIncluding": "7.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "7.2.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: hold a connection reference for each session channel\n\nksmbd_session_unregister() removes a session from the global and per-\nconnection tables before dropping the table reference. A concurrent\nreference holder can keep the session and its channel list alive after\nthose removals.\n\nConnection cleanup can no longer find the unpublished session to remove its\nchannels. Since a channel only stores a raw conn pointer, the connection\ncan be freed while another session reference holder is still accessing it,\nfor example during SMB3.1.1 binding or a procfs read.\n\nTake a connection reference when registering a channel and release it on\ninsertion failure, channel removal, or final session destruction. Keep the\nchannels and signing keys until the session is destroyed so a response can\nstill be signed after the session has been unregistered."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - register_session_channel() runs from smb2_sess_setup() after ksmbd_conn_handler_loop() queues an SMB2 SESSION_SETUP read from the TCP socket. That command stores the connection in chann-\u003econn without a reference; a later failing SESSION_SETUP calls ksmbd_session_unregister(), and ksmbd_conn_free() can free it while the channel still points at it.\nAC:H - ksmbd_session_unregister() drops an established session only after session_setup_reauth sets SMB2_SESSION_IN_PROGRESS because sess-\u003ekerberos_expiry has passed. The attacker\u0027s chann-\u003econn-\u003ecipher_type read is smb2_sess_setup()\u0027s SMB 3.1.1 binding arm, entered only when KSMBD_GLOBAL_FLAG_SMB3_MULTICHANNEL is already set, immediately after ksmbd_session_lookup_slowpath(), with no delay the attacker can hold across __ksmbd_conn_release_work().\nPR:L - register_session_channel() writes chann-\u003econn only after ntlm_authenticate() or krb5_authenticate() succeeds, and the reauth path that unregisters a session which already has channels depends on kerberos_expiry set by ksmbd_krb5_authenticate(). A SESSION_SETUP rejected before authentication stores no channel.\nUI:N - The client sends the SESSION_SETUP that registers the channel, the failing reauth SESSION_SETUP that calls ksmbd_session_unregister(), and the TCP close that reaches ksmbd_server_terminate_conn() and ksmbd_conn_free().\nS:U - The freed object is a ksmbd_conn in the host kernel that serves this SMB session, so the corruption stays in that kernel security authority.\nC:H - __ksmbd_conn_release_work() kfree_sensitive()s the conn while the channel keeps the pointer. smb2_sess_setup() then reads chann-\u003econn-\u003ecipher_type, and show_proc_session() follows chan-\u003econn-\u003evals and inet_addr; reclaiming the slab lets those uses disclose the replacement object.\nI:H - show_proc_session() down_read()s chan-\u003econn-\u003esession_lock through the channel\u0027s raw pointer after the connection can already have been freed, writing the rwsem of whatever reused that slot. The use-after-free of ksmbd_conn is a heap write against that allocation.\nA:H - smb2_sess_setup()\u0027s read of chann-\u003econn-\u003ecipher_type and show_proc_session()\u0027s lock of chan-\u003econn-\u003esession_lock both use the ksmbd_conn after __ksmbd_conn_release_work() freed it, which oopses the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T16:57:40.367Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4b333aed69cfc2c8687b86b6a4364a0dffc16dd8"
        },
        {
          "url": "https://git.kernel.org/stable/c/add8d7fb04efe564193df73581889c62fc0016f1"
        }
      ],
      "title": "ksmbd: hold a connection reference for each session channel",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99277",
    "datePublished": "2026-11-07T14:08:46.710Z",
    "dateReserved": "2026-09-25T10:25:14.405Z",
    "dateUpdated": "2026-11-10T16:57:40.367Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-99274 (GCVE-0-2026-99274)

    Vulnerability from cvelistv5 – Published: 2026-11-07 14:08 – Updated: 2026-11-10 18:15
    VLAI
    Title
    smb: client: fix fiemap wild read on empty truncated response
    Summary
    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix fiemap wild read on empty truncated response smb3_fiemap() treats -E2BIG from SMB2_ioctl() as a truncated range blob and loops for the next chunk. If the server reports STATUS_BUFFER_OVERFLOW with OutputCount == 0, SMB2_ioctl() returns -E2BIG with out_data == NULL and out_data_len == 0, and the existing length checks accept the empty result. The loop then evaluates next = out_data[num - 1].file_offset + ... with num == 0, reading 16 bytes before NULL. Reject a truncated range blob that contains no range, so the resume offset is never computed from an empty response. Also require the last range in a truncated blob to advance the resume offset without overflowing, and to stay within the requested range; a malicious or broken server could otherwise make no progress or underflow len and loop forever. Free the previous response buffer before retrying. Reproduced on 6.6.87.2 with a malicious SMB2 server that answers FSCTL_QUERY_ALLOCATED_RANGES with STATUS_BUFFER_OVERFLOW and OutputCount == 0; an FS_IOC_FIEMAP ioctl on the mount oopses in cifs_fiemap() with CR2 = fffffffffffffff8. The code path is unchanged on mainline.
    Severity
    No CVSS data available.
    Assigner
    Linux CNA
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 2f3ebaba13cebd8badfb9aed31c0cf3cc82eb4f4 , < 8e0d425b808c367f5033eb72aa4528ae18473627 (git)
    Affected: 2f3ebaba13cebd8badfb9aed31c0cf3cc82eb4f4 , < 4a426ca5be7e3dedbe76575b967db04fbf01136f (git)
    Affected: 2f3ebaba13cebd8badfb9aed31c0cf3cc82eb4f4 , < 31f6dbb29fe17fa9595c7e8b19fd92915b03a4ca (git)
    Affected: 2f3ebaba13cebd8badfb9aed31c0cf3cc82eb4f4 , < f5baa17a0f316c235d61623ac8e8fb32c2b3c0cc (git)
    		Create a notification for this product.
    Linux Linux Affected: 5.2
    Unaffected: 0 , < 5.2 (semver)
    Unaffected: 6.12.117 , ≤ 6.12.* (semver)
    Unaffected: 6.18.61 , ≤ 6.18.* (semver)
    Unaffected: 7.3.2 , ≤ 7.3.* (semver)
    Unaffected: 7.4-rc1 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8e0d425b808c367f5033eb72aa4528ae18473627",
              "status": "affected",
              "version": "2f3ebaba13cebd8badfb9aed31c0cf3cc82eb4f4",
              "versionType": "git"
            },
            {
              "lessThan": "4a426ca5be7e3dedbe76575b967db04fbf01136f",
              "status": "affected",
              "version": "2f3ebaba13cebd8badfb9aed31c0cf3cc82eb4f4",
              "versionType": "git"
            },
            {
              "lessThan": "31f6dbb29fe17fa9595c7e8b19fd92915b03a4ca",
              "status": "affected",
              "version": "2f3ebaba13cebd8badfb9aed31c0cf3cc82eb4f4",
              "versionType": "git"
            },
            {
              "lessThan": "f5baa17a0f316c235d61623ac8e8fb32c2b3c0cc",
              "status": "affected",
              "version": "2f3ebaba13cebd8badfb9aed31c0cf3cc82eb4f4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2ops.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.3.*",
              "status": "unaffected",
              "version": "7.3.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.4-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.117",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.61",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3.2",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.4-rc1",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix fiemap wild read on empty truncated response\n\nsmb3_fiemap() treats -E2BIG from SMB2_ioctl() as a truncated range blob\nand loops for the next chunk. If the server reports\nSTATUS_BUFFER_OVERFLOW with OutputCount == 0, SMB2_ioctl() returns\n-E2BIG with out_data == NULL and out_data_len == 0, and the existing\nlength checks accept the empty result. The loop then evaluates\n\n\tnext = out_data[num - 1].file_offset + ...\n\nwith num == 0, reading 16 bytes before NULL.\n\nReject a truncated range blob that contains no range, so the resume\noffset is never computed from an empty response. Also require the last\nrange in a truncated blob to advance the resume offset without\noverflowing, and to stay within the requested range; a malicious or\nbroken server could otherwise make no progress or underflow len and loop\nforever. Free the previous response buffer before retrying.\n\nReproduced on 6.6.87.2 with a malicious SMB2 server that answers\nFSCTL_QUERY_ALLOCATED_RANGES with STATUS_BUFFER_OVERFLOW and\nOutputCount == 0; an FS_IOC_FIEMAP ioctl on the mount oopses in\ncifs_fiemap() with CR2 = fffffffffffffff8. The code path is unchanged\non mainline."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:15:27.974Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8e0d425b808c367f5033eb72aa4528ae18473627"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a426ca5be7e3dedbe76575b967db04fbf01136f"
        },
        {
          "url": "https://git.kernel.org/stable/c/31f6dbb29fe17fa9595c7e8b19fd92915b03a4ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/f5baa17a0f316c235d61623ac8e8fb32c2b3c0cc"
        }
      ],
      "title": "smb: client: fix fiemap wild read on empty truncated response",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99274",
    "datePublished": "2026-11-07T14:08:45.924Z",
    "dateReserved": "2026-09-25T10:25:14.405Z",
    "dateUpdated": "2026-11-10T18:15:27.974Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-99273 (GCVE-0-2026-99273)

    Vulnerability from cvelistv5 – Published: 2026-11-07 14:08 – Updated: 2026-11-10 18:15
    VLAI
    Title
    ksmbd: reserve space for the UTF-16 terminator in stream info
    Summary
    In the Linux kernel, the following vulnerability has been resolved: ksmbd: reserve space for the UTF-16 terminator in stream info smb_strtoUTF16() always writes a terminating zero UTF-16 unit after the converted characters, but get_file_stream_info() budgets only sizeof(struct smb2_file_stream_info) + streamlen * 2 for a stream entry and sizeof(struct smb2_file_stream_info) + 7 * 2 for the trailing "::$DATA" entry. When an entry exactly fills the 448-byte small response buffer, the terminator is written two bytes past the allocation. Reserve one extra UTF-16 unit in both budget checks. The terminator is not part of the wire format, so the reported lengths are unchanged.
    Severity
    No CVSS data available.
    Assigner
    Linux CNA
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 583ede545a14f275a959772b5e1e50fe3e14b861 (git)
    Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 06a751809ebd33e95b05bf733697318a17a4872b (git)
    Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 0e64f89563164719ceb1aa33f2a8bfd6391fa340 (git)
    Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a025c4991a7d83edc4dd339e3ea86d8ff6226eca (git)
    Affected: 0 , < 6.12.117 (semver)
    Affected: 0 , < 6.18.61 (semver)
    Affected: 0 , < 7.3.2 (semver)
    		Create a notification for this product.
    Linux Linux Unaffected: 6.12.117 , ≤ 6.12.* (semver)
    Unaffected: 6.18.61 , ≤ 6.18.* (semver)
    Unaffected: 7.3.2 , ≤ 7.3.* (semver)
    Unaffected: 7.4-rc1 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "583ede545a14f275a959772b5e1e50fe3e14b861",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "06a751809ebd33e95b05bf733697318a17a4872b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "0e64f89563164719ceb1aa33f2a8bfd6391fa340",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "a025c4991a7d83edc4dd339e3ea86d8ff6226eca",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.117",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.61",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.3.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.3.*",
              "status": "unaffected",
              "version": "7.3.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.4-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.117",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.61",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.4-rc1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: reserve space for the UTF-16 terminator in stream info\n\nsmb_strtoUTF16() always writes a terminating zero UTF-16 unit after the\nconverted characters, but get_file_stream_info() budgets only\nsizeof(struct smb2_file_stream_info) + streamlen * 2 for a stream entry\nand sizeof(struct smb2_file_stream_info) + 7 * 2 for the trailing\n\"::$DATA\" entry. When an entry exactly fills the 448-byte small response\nbuffer, the terminator is written two bytes past the allocation.\n\nReserve one extra UTF-16 unit in both budget checks. The terminator is\nnot part of the wire format, so the reported lengths are unchanged."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:15:27.637Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/583ede545a14f275a959772b5e1e50fe3e14b861"
        },
        {
          "url": "https://git.kernel.org/stable/c/06a751809ebd33e95b05bf733697318a17a4872b"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e64f89563164719ceb1aa33f2a8bfd6391fa340"
        },
        {
          "url": "https://git.kernel.org/stable/c/a025c4991a7d83edc4dd339e3ea86d8ff6226eca"
        }
      ],
      "title": "ksmbd: reserve space for the UTF-16 terminator in stream info",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99273",
    "datePublished": "2026-11-07T14:08:45.585Z",
    "dateReserved": "2026-09-25T10:25:14.405Z",
    "dateUpdated": "2026-11-10T18:15:27.637Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-99271 (GCVE-0-2026-99271)

    Vulnerability from cvelistv5 – Published: 2026-11-07 14:08 – Updated: 2026-11-10 18:15
    VLAI
    Title
    ALSA: line6: Clear prev_fbuf on capture buffer release
    Summary
    In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: Clear prev_fbuf on capture buffer release A KASAN slab-use-after-free read was reported in submit_audio_out_urb() when generating an impulse test signal: BUG: KASAN: slab-use-after-free in create_impulse_test_signal sound/usb/line6/playback.c:76 [inline] BUG: KASAN: slab-use-after-free in submit_audio_out_urb+0x1848/0x1b20 sound/usb/line6/playback.c:249 Read of size 2 at addr ffff888008d74870 by task syz.2.3214/7785 Allocated by task 11: kmem_cache_alloc_noprof+0x2f0/0x390 mm/slub.c:4144 line6_buffer_acquire+0x1a1/0x220 sound/usb/line6/pcm.c:158 line6_pcm_acquire+0xb6/0x230 sound/usb/line6/pcm.c:329 line6_startup_work+0x3c/0x50 sound/usb/line6/driver.c:728 Freed by task 7785: kfree+0xf8/0x390 mm/slub.c:6566 line6_buffer_release sound/usb/line6/pcm.c:176 [inline] line6_buffer_release+0xa5/0xf0 sound/usb/line6/pcm.c:170 __line6_pcm_release sound/usb/line6/pcm.c:305 [inline] line6_pcm_release+0x5a/0x80 sound/usb/line6/pcm.c:313 snd_toneport_monitor_put+0x11b/0x190 sound/usb/line6/toneport.c:183 line6pcm->prev_fbuf points into the capture PCM stream buffer (line6pcm->in.buffer), which is updated during audio_in_callback() to feed rate synchronization, software monitoring, and impulse test signal generation on playback side. When all capture streams are closed, line6_buffer_release() frees pstr->buffer with kfree(). However, it does not clear line6pcm->prev_fbuf. If playback is subsequently started (e.g. via impulse test signal volume control snd_line6_impulse_volume_put()), submit_audio_out_urb() dereferences the stale pointer line6pcm->prev_fbuf under in.lock, resulting in a slab-use-after-free read. Clear prev_fbuf and prev_fsize in line6_buffer_release() when releasing the capture stream buffer under in.lock, ensuring that no stale buffer pointer can be accessed by submit_audio_out_urb().
    Severity
    No CVSS data available.
    Assigner
    Linux CNA
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 63e20df1e5b2ef8d871ecbdb6c038d554ed1ca74 , < d063975ed22cdc2cb609a9828e5f658448193606 (git)
    Affected: 63e20df1e5b2ef8d871ecbdb6c038d554ed1ca74 , < 862d9268f40a6e10cef24eb226e738fb69ce8aa7 (git)
    Affected: 63e20df1e5b2ef8d871ecbdb6c038d554ed1ca74 , < 22c82f33ff0b68d37041adf1dea5533a5863cd31 (git)
    Affected: 63e20df1e5b2ef8d871ecbdb6c038d554ed1ca74 , < aa118c8f61d59387961d58ffae831c5259a9f222 (git)
    		Create a notification for this product.
    Linux Linux Affected: 4.0
    Unaffected: 0 , < 4.0 (semver)
    Unaffected: 6.12.117 , ≤ 6.12.* (semver)
    Unaffected: 6.18.61 , ≤ 6.18.* (semver)
    Unaffected: 7.3.2 , ≤ 7.3.* (semver)
    Unaffected: 7.4-rc1 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/line6/pcm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d063975ed22cdc2cb609a9828e5f658448193606",
              "status": "affected",
              "version": "63e20df1e5b2ef8d871ecbdb6c038d554ed1ca74",
              "versionType": "git"
            },
            {
              "lessThan": "862d9268f40a6e10cef24eb226e738fb69ce8aa7",
              "status": "affected",
              "version": "63e20df1e5b2ef8d871ecbdb6c038d554ed1ca74",
              "versionType": "git"
            },
            {
              "lessThan": "22c82f33ff0b68d37041adf1dea5533a5863cd31",
              "status": "affected",
              "version": "63e20df1e5b2ef8d871ecbdb6c038d554ed1ca74",
              "versionType": "git"
            },
            {
              "lessThan": "aa118c8f61d59387961d58ffae831c5259a9f222",
              "status": "affected",
              "version": "63e20df1e5b2ef8d871ecbdb6c038d554ed1ca74",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/usb/line6/pcm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.0"
            },
            {
              "lessThan": "4.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.3.*",
              "status": "unaffected",
              "version": "7.3.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.4-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.117",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.61",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3.2",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.4-rc1",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: line6: Clear prev_fbuf on capture buffer release\n\nA KASAN slab-use-after-free read was reported in submit_audio_out_urb()\nwhen generating an impulse test signal:\n\n  BUG: KASAN: slab-use-after-free in create_impulse_test_signal sound/usb/line6/playback.c:76 [inline]\n  BUG: KASAN: slab-use-after-free in submit_audio_out_urb+0x1848/0x1b20 sound/usb/line6/playback.c:249\n  Read of size 2 at addr ffff888008d74870 by task syz.2.3214/7785\n\n  Allocated by task 11:\n   kmem_cache_alloc_noprof+0x2f0/0x390 mm/slub.c:4144\n   line6_buffer_acquire+0x1a1/0x220 sound/usb/line6/pcm.c:158\n   line6_pcm_acquire+0xb6/0x230 sound/usb/line6/pcm.c:329\n   line6_startup_work+0x3c/0x50 sound/usb/line6/driver.c:728\n\n  Freed by task 7785:\n   kfree+0xf8/0x390 mm/slub.c:6566\n   line6_buffer_release sound/usb/line6/pcm.c:176 [inline]\n   line6_buffer_release+0xa5/0xf0 sound/usb/line6/pcm.c:170\n   __line6_pcm_release sound/usb/line6/pcm.c:305 [inline]\n   line6_pcm_release+0x5a/0x80 sound/usb/line6/pcm.c:313\n   snd_toneport_monitor_put+0x11b/0x190 sound/usb/line6/toneport.c:183\n\nline6pcm-\u003eprev_fbuf points into the capture PCM stream buffer\n(line6pcm-\u003ein.buffer), which is updated during audio_in_callback() to\nfeed rate synchronization, software monitoring, and impulse test signal\ngeneration on playback side.\n\nWhen all capture streams are closed, line6_buffer_release() frees\npstr-\u003ebuffer with kfree().  However, it does not clear line6pcm-\u003eprev_fbuf.\nIf playback is subsequently started (e.g. via impulse test signal\nvolume control snd_line6_impulse_volume_put()), submit_audio_out_urb()\ndereferences the stale pointer line6pcm-\u003eprev_fbuf under in.lock,\nresulting in a slab-use-after-free read.\n\nClear prev_fbuf and prev_fsize in line6_buffer_release() when releasing\nthe capture stream buffer under in.lock, ensuring that no stale buffer\npointer can be accessed by submit_audio_out_urb()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:15:27.042Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d063975ed22cdc2cb609a9828e5f658448193606"
        },
        {
          "url": "https://git.kernel.org/stable/c/862d9268f40a6e10cef24eb226e738fb69ce8aa7"
        },
        {
          "url": "https://git.kernel.org/stable/c/22c82f33ff0b68d37041adf1dea5533a5863cd31"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa118c8f61d59387961d58ffae831c5259a9f222"
        }
      ],
      "title": "ALSA: line6: Clear prev_fbuf on capture buffer release",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99271",
    "datePublished": "2026-11-07T14:08:45.047Z",
    "dateReserved": "2026-09-25T10:25:14.404Z",
    "dateUpdated": "2026-11-10T18:15:27.042Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-100081 (GCVE-0-2026-100081)

    Vulnerability from cvelistv5 – Published: 2026-11-06 18:23 – Updated: 2026-11-10 16:57
    VLAI
    Title
    xen-netback: defer xenvif_mcast_addr_list_free()
    Summary
    In the Linux kernel, the following vulnerability has been resolved: xen-netback: defer xenvif_mcast_addr_list_free() In order for the function to legitimately avoid locking/RCU, it needs to run after all TX/RX processing has finished/stopped: Lookups happen from xenvif_start_xmit(), while adds/removes happen from xenvif_tx_action() (called out of xenvif_poll()). Move the call out of xenvif_disconnect_data() (the call to the function from connect()'s error path doesn't require any cleaning up there), and put it past the synchronization point in backend_disconnect(). This is XSA-527 / CVE-2026-100081.
    Severity
    7.8 (High)
    CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
    Assigner
    Linux CNA
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: b17075d5c1988b83f840d272c795ac17d57ce804 , < 96e05a8ce243e2207704e2e7a6e7d1172730f515 (git)
    Affected: b17075d5c1988b83f840d272c795ac17d57ce804 , < 0e786123e46d08d2247ce93a5435e45ed9f4c5d1 (git)
    Affected: b17075d5c1988b83f840d272c795ac17d57ce804 , < 990d123d9eaa3ac6c979eed245658676d65ce0db (git)
    Affected: b17075d5c1988b83f840d272c795ac17d57ce804 , < 0d515c409033c8e2a645a781be3ca76ab825fc8c (git)
    Affected: b17075d5c1988b83f840d272c795ac17d57ce804 , < a6bb2f1fa62c56279bdcdadce28d1310c5e12b62 (git)
    Affected: b17075d5c1988b83f840d272c795ac17d57ce804 , < 34f0f63dc6dc11895a17bb5672451b6b11622c99 (git)
    Affected: b17075d5c1988b83f840d272c795ac17d57ce804 , < fb38fc58acb26d74fe8f7b19621fafaae3c040ff (git)
    		Create a notification for this product.
    Linux Linux Affected: 4.11
    Unaffected: 0 , < 4.11 (semver)
    Unaffected: 5.10.274 , ≤ 5.10.* (semver)
    Unaffected: 5.15.225 , ≤ 5.15.* (semver)
    Unaffected: 6.1.192 , ≤ 6.1.* (semver)
    Unaffected: 6.6.162 , ≤ 6.6.* (semver)
    Unaffected: 6.12.116 , ≤ 6.12.* (semver)
    Unaffected: 6.18.62 , ≤ 6.18.* (semver)
    Unaffected: 7.3.3 , ≤ 7.3.* (semver)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-11-06T19:08:43.050Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/11/06/10"
          },
          {
            "url": "http://xenbits.xen.org/xsa/advisory-527.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/xen-netback/interface.c",
            "drivers/net/xen-netback/xenbus.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "96e05a8ce243e2207704e2e7a6e7d1172730f515",
              "status": "affected",
              "version": "b17075d5c1988b83f840d272c795ac17d57ce804",
              "versionType": "git"
            },
            {
              "lessThan": "0e786123e46d08d2247ce93a5435e45ed9f4c5d1",
              "status": "affected",
              "version": "b17075d5c1988b83f840d272c795ac17d57ce804",
              "versionType": "git"
            },
            {
              "lessThan": "990d123d9eaa3ac6c979eed245658676d65ce0db",
              "status": "affected",
              "version": "b17075d5c1988b83f840d272c795ac17d57ce804",
              "versionType": "git"
            },
            {
              "lessThan": "0d515c409033c8e2a645a781be3ca76ab825fc8c",
              "status": "affected",
              "version": "b17075d5c1988b83f840d272c795ac17d57ce804",
              "versionType": "git"
            },
            {
              "lessThan": "a6bb2f1fa62c56279bdcdadce28d1310c5e12b62",
              "status": "affected",
              "version": "b17075d5c1988b83f840d272c795ac17d57ce804",
              "versionType": "git"
            },
            {
              "lessThan": "34f0f63dc6dc11895a17bb5672451b6b11622c99",
              "status": "affected",
              "version": "b17075d5c1988b83f840d272c795ac17d57ce804",
              "versionType": "git"
            },
            {
              "lessThan": "fb38fc58acb26d74fe8f7b19621fafaae3c040ff",
              "status": "affected",
              "version": "b17075d5c1988b83f840d272c795ac17d57ce804",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/xen-netback/interface.c",
            "drivers/net/xen-netback/xenbus.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.274",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.225",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.192",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.116",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.62",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.3.*",
              "status": "unaffected",
              "version": "7.3.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.274",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.225",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.192",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.162",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.116",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.62",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3.3",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen-netback: defer xenvif_mcast_addr_list_free()\n\nIn order for the function to legitimately avoid locking/RCU, it needs to\nrun after all TX/RX processing has finished/stopped: Lookups happen from\nxenvif_start_xmit(), while adds/removes happen from xenvif_tx_action()\n(called out of xenvif_poll()).\n\nMove the call out of xenvif_disconnect_data() (the call to the function\nfrom connect()\u0027s error path doesn\u0027t require any cleaning up there), and\nput it past the synchronization point in backend_disconnect().\n\nThis is XSA-527 / CVE-2026-100081."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The guest reaches the free by changing xenbus state: frontend_changed() calls set_backend_state(), which from XenbusStateConnected calls backend_disconnect() and xenvif_disconnect_data(), where xenvif_mcast_addr_list_free() ran before synchronize_net(). The raced lookup is xenvif_mcast_match() inside xenvif_start_xmit(); the trigger is that xenbus write, not a routable packet field.\nAC:H - xenvif_mcast_match() runs only when xenvif_start_xmit() has already seen VIF_STATUS_CONNECTED and a live queue-\u003etask, but xenvif_mcast_addr_list_free() runs only after xenvif_carrier_off() clears that bit and xenvif_disconnect_queue() returns from kthread_stop(). The lookup does not sleep, so it must be stalled across that teardown; MCAST_ADD plus Closing does not create that stall, and napi_disable() has already finished xenvif_tx_action().\nPR:L - frontend_changed() is the vif backend otherend_changed callback and accepts any connected frontend. The attacker must control that guest\u0027s xenstore frontend state and TX ring, i.e. the guest kernel; a host user namespace has no path to this xenbus backend.\nUI:N - The guest writes its own request-multicast-control key, queues XEN_NETIF_EXTRA_TYPE_MCAST_ADD on the TX ring, and sets the frontend xenbus state to Closing. The host operator does not have to mount media, open a device, or acknowledge a prompt.\nS:C - The use-after-free is in dom0 xen-netback: xenvif_mcast_match() dereferences vif-\u003efe_mcast_addr nodes freed by xenvif_mcast_addr_list_free(). A guest that wins the race crashes or corrupts that backend kernel, crossing the Xen guest-to-host boundary.\nC:H - xenvif_mcast_match() walks fe_mcast_addr under rcu_read_lock() via list_for_each_entry_rcu() and ether_addr_equal() on mcast-\u003eaddr, while xenvif_mcast_addr_list_free() kfree()s those xenvif_mcast_addr nodes with no grace period. A reused node lets the walk follow next pointers into other kernel memory.\nI:H - The freed objects are slab allocations from kzalloc_obj() in xenvif_mcast_add(). xenvif_mcast_match() can still dereference them after kfree() in xenvif_mcast_addr_list_free(), a heap use-after-free in the backend rather than a NULL deref, and XSA-527 treats host privilege escalation from that race as possible.\nA:H - A list walk in xenvif_mcast_match() that follows an fe_mcast_addr node already passed to kfree() by xenvif_mcast_addr_list_free() oopses the backend kernel. XSA-527 describes that fault as a driver crash that can take down the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T16:57:39.730Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/96e05a8ce243e2207704e2e7a6e7d1172730f515"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e786123e46d08d2247ce93a5435e45ed9f4c5d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/990d123d9eaa3ac6c979eed245658676d65ce0db"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d515c409033c8e2a645a781be3ca76ab825fc8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6bb2f1fa62c56279bdcdadce28d1310c5e12b62"
        },
        {
          "url": "https://git.kernel.org/stable/c/34f0f63dc6dc11895a17bb5672451b6b11622c99"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb38fc58acb26d74fe8f7b19621fafaae3c040ff"
        }
      ],
      "title": "xen-netback: defer xenvif_mcast_addr_list_free()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-100081",
    "datePublished": "2026-11-06T18:23:02.185Z",
    "dateReserved": "2026-09-25T10:25:14.456Z",
    "dateUpdated": "2026-11-10T16:57:39.730Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-99270 (GCVE-0-2026-99270)

    Vulnerability from cvelistv5 – Published: 2026-11-03 12:32 – Updated: 2026-11-10 18:15
    VLAI
    Title
    tcp: Fix potential UAF in reqsk_timer_handler().
    Summary
    In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler(). When TCP socket migration fails at inet_ehash_insert() in reqsk_timer_handler(), we jump to the no_ownership: label and free the new reqsk immediately with __reqsk_free(). Thus, we must stop the new reqsk's timer before jumping to the label, but the timer might be missed since the cited commit, resulting in UAF. As we are in the original reqsk's timer context, we can safely call timer_delete_sync() for the new reqsk. Let's pass false to __inet_csk_reqsk_queue_drop() to stop the new reqsk's timer.
    Severity
    8.1 (High)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    Assigner
    Linux CNA
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 83fccfc3940c4a2db90fd7e7079f5b465cd8c6af , < f7fba81b00699360f96ed7d9a47b8c801e74c6f9 (git)
    Affected: 83fccfc3940c4a2db90fd7e7079f5b465cd8c6af , < b3b56e95f6fad7fa7281450b443e861d82616fdb (git)
    Affected: 83fccfc3940c4a2db90fd7e7079f5b465cd8c6af , < 97c8a3c1f73d828de43a5a88e8a9a143efb2b661 (git)
    Affected: d3a1196bfc462943694623412d8e03aaf172bdc1 (git)
    Affected: 4.1.11 , < 4.2 (semver)
    		Create a notification for this product.
    Linux Linux Affected: 4.2
    Unaffected: 0 , < 4.2 (semver)
    Unaffected: 6.12.117 , ≤ 6.12.* (semver)
    Unaffected: 6.18.61 , ≤ 6.18.* (semver)
    Unaffected: 7.1 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/inet_connection_sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f7fba81b00699360f96ed7d9a47b8c801e74c6f9",
              "status": "affected",
              "version": "83fccfc3940c4a2db90fd7e7079f5b465cd8c6af",
              "versionType": "git"
            },
            {
              "lessThan": "b3b56e95f6fad7fa7281450b443e861d82616fdb",
              "status": "affected",
              "version": "83fccfc3940c4a2db90fd7e7079f5b465cd8c6af",
              "versionType": "git"
            },
            {
              "lessThan": "97c8a3c1f73d828de43a5a88e8a9a143efb2b661",
              "status": "affected",
              "version": "83fccfc3940c4a2db90fd7e7079f5b465cd8c6af",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d3a1196bfc462943694623412d8e03aaf172bdc1",
              "versionType": "git"
            },
            {
              "lessThan": "4.2",
              "status": "affected",
              "version": "4.1.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/inet_connection_sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.117",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.61",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.1.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix potential UAF in reqsk_timer_handler().\n\nWhen TCP socket migration fails at inet_ehash_insert() in\nreqsk_timer_handler(), we jump to the no_ownership: label\nand free the new reqsk immediately with __reqsk_free().\n\nThus, we must stop the new reqsk\u0027s timer before jumping to the\nlabel, but the timer might be missed since the cited commit,\nresulting in UAF.\n\nAs we are in the original reqsk\u0027s timer context, we can safely\ncall timer_delete_sync() for the new reqsk.\n\nLet\u0027s pass false to __inet_csk_reqsk_queue_drop() to stop\nthe new reqsk\u0027s timer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A TCP SYN handled by tcp_v4_rcv()/tcp_v6_rcv() \u2192 tcp_conn_request() \u2192 reqsk_queue_hash_req() allocates the request_sock and arms reqsk_timer_handler(); a later ACK on that 4-tuple is processed by tcp_check_req()/inet_ehash_nolisten() and makes inet_ehash_insert(nreq, oreq) fail. Those handshake segments are the attacker-controlled input and they arrive on routable TCP.\nAC:H - The buggy nreq path in reqsk_timer_handler() runs only when inet_sk_state_load(sk_listener)!=TCP_LISTEN and reuseport_migrate_sock() clones the req, which requires a non-default net.ipv4.tcp_migrate_req (default 0) or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program plus close/shutdown of the listener. A remote peer cannot create that listener state on demand, even though the subsequent own_req race is attacker-driven.\nPR:N - The SYN is accepted in tcp_conn_request() while the socket is still TCP_NEW_SYN_RECV, before accept() and before any application credential check; reqsk_queue_hash_req() arms the timer with no uid, capability, or session requirement on the peer.\nUI:N - The attacker sends the SYN that creates oreq and the ACK that unhashes it so inet_ehash_insert() fails in reqsk_timer_handler(); no local user must mount, open, or confirm anything.\nS:U - The use-after-free is of the cloned nreq request_sock (rsk_timer, rsk_listener, rsk_ops) in the host kernel\u0027s request_sock slab; it does not cross a VM, IOMMU, or sandbox boundary.\nC:H - On inet_ehash_insert() failure, no_ownership calls __reqsk_free(nreq) while nreq-\u003ersk_timer is still pending, so the next reqsk_timer_handler() reads rsk_listener and rsk_ops from freed memory. Further SYNs allocate from the same tcp_request_sock slab, giving a UAF read of attacker-shaped contents.\nI:H - The leftover nreq timer continues into reqsk_put/__reqsk_free on the already-freed object, decrementing a reused refcount and calling rsk_ops-\u003edestructor from sprayed request_sock memory, which is a UAF write and control-flow primitive.\nA:H - reqsk_timer_handler() running on the freed nreq dereferences a stale rsk_listener or double-frees the slab object in timer softirq, which oopses or panics the kernel for each migrated handshake whose ehash replace fails."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:15:26.715Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f7fba81b00699360f96ed7d9a47b8c801e74c6f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3b56e95f6fad7fa7281450b443e861d82616fdb"
        },
        {
          "url": "https://git.kernel.org/stable/c/97c8a3c1f73d828de43a5a88e8a9a143efb2b661"
        }
      ],
      "title": "tcp: Fix potential UAF in reqsk_timer_handler().",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99270",
    "datePublished": "2026-11-03T12:32:09.364Z",
    "dateReserved": "2026-09-25T10:25:14.404Z",
    "dateUpdated": "2026-11-10T18:15:26.715Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-99172 (GCVE-0-2026-99172)

    Vulnerability from cvelistv5 – Published: 2026-10-28 10:35 – Updated: 2026-11-10 18:15
    VLAI
    Title
    ipc: drop the mqueue mount with kern_unmount() on setup failure
    Summary
    In the Linux kernel, the following vulnerability has been resolved: ipc: drop the mqueue mount with kern_unmount() on setup failure mq_init_ns() creates the mqueue mount with fc_mount_longterm(), so its ->mnt_ns is MNT_NS_INTERNAL. When setting up the mqueue or ipc sysctls or msg_init_ns() fails afterwards, create_ipc_ns() drops it with a plain mntput(). With ->mnt_ns set that takes the fast path of mntput_no_expire(). The count drops to zero and nothing ever kills the mount, so the mount and the mqueue superblock are leaked. Commit dc55e35f9e81 ("ipc: Store mqueue sysctls in the ipc namespace") added the first failure path after mq_init_ns() and never dropped the mount. Commit 7229d74e5e8c ("ipc: create_ipc_ns: drop mqueue mount on sysctl setup failure") tried to fix that with a mntput() but that doesn't help for a long-term mount. Use kern_unmount(). free_ipc() open-codes the same thing for a namespace that made it.
    Severity
    No CVSS data available.
    Assigner
    Linux CNA
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: dc55e35f9e810f23dd69cfdc91a3d636023f57a2 , < 4dd36cf72d2c6c090958c0d7b542fa8211635d2d (git)
    Affected: dc55e35f9e810f23dd69cfdc91a3d636023f57a2 , < 4aef6ceb4d6acacd53bc047ac4849677c3edbec1 (git)
    Affected: dc55e35f9e810f23dd69cfdc91a3d636023f57a2 , < c0620b648321fff654173d238d4a85298ea16d05 (git)
    Affected: dc55e35f9e810f23dd69cfdc91a3d636023f57a2 , < f0e48172a59e517e613b73f73cc35f24fd123aeb (git)
    		Create a notification for this product.
    Linux Linux Affected: 5.19
    Unaffected: 0 , < 5.19 (semver)
    Unaffected: 6.12.117 , ≤ 6.12.* (semver)
    Unaffected: 6.18.61 , ≤ 6.18.* (semver)
    Unaffected: 7.2.13 , ≤ 7.2.* (semver)
    Unaffected: 7.3 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "ipc/namespace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4dd36cf72d2c6c090958c0d7b542fa8211635d2d",
              "status": "affected",
              "version": "dc55e35f9e810f23dd69cfdc91a3d636023f57a2",
              "versionType": "git"
            },
            {
              "lessThan": "4aef6ceb4d6acacd53bc047ac4849677c3edbec1",
              "status": "affected",
              "version": "dc55e35f9e810f23dd69cfdc91a3d636023f57a2",
              "versionType": "git"
            },
            {
              "lessThan": "c0620b648321fff654173d238d4a85298ea16d05",
              "status": "affected",
              "version": "dc55e35f9e810f23dd69cfdc91a3d636023f57a2",
              "versionType": "git"
            },
            {
              "lessThan": "f0e48172a59e517e613b73f73cc35f24fd123aeb",
              "status": "affected",
              "version": "dc55e35f9e810f23dd69cfdc91a3d636023f57a2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "ipc/namespace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.117",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.61",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.13",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipc: drop the mqueue mount with kern_unmount() on setup failure\n\nmq_init_ns() creates the mqueue mount with fc_mount_longterm(), so its\n-\u003emnt_ns is MNT_NS_INTERNAL. When setting up the mqueue or ipc sysctls\nor msg_init_ns() fails afterwards, create_ipc_ns() drops it with a plain\nmntput(). With -\u003emnt_ns set that takes the fast path of\nmntput_no_expire(). The count drops to zero and nothing ever kills the\nmount, so the mount and the mqueue superblock are leaked.\n\nCommit dc55e35f9e81 (\"ipc: Store mqueue sysctls in the ipc namespace\")\nadded the first failure path after mq_init_ns() and never dropped the\nmount. Commit 7229d74e5e8c (\"ipc: create_ipc_ns: drop mqueue mount on\nsysctl setup failure\") tried to fix that with a mntput() but that\ndoesn\u0027t help for a long-term mount.\n\nUse kern_unmount(). free_ipc() open-codes the same thing for a namespace\nthat made it."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:15:26.226Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4dd36cf72d2c6c090958c0d7b542fa8211635d2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/4aef6ceb4d6acacd53bc047ac4849677c3edbec1"
        },
        {
          "url": "https://git.kernel.org/stable/c/c0620b648321fff654173d238d4a85298ea16d05"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0e48172a59e517e613b73f73cc35f24fd123aeb"
        }
      ],
      "title": "ipc: drop the mqueue mount with kern_unmount() on setup failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99172",
    "datePublished": "2026-10-28T10:35:27.245Z",
    "dateReserved": "2026-09-25T10:25:14.399Z",
    "dateUpdated": "2026-11-10T18:15:26.226Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-99146 (GCVE-0-2026-99146)

    Vulnerability from cvelistv5 – Published: 2026-10-28 10:35 – Updated: 2026-11-10 18:15
    VLAI
    Title
    drm/i915/dmc: Add sanity check for DMC load address
    Summary
    In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Add sanity check for DMC load address For DMC firmware header version 3, the firmware load address is stored in dmc_info->start_mmioaddr and later used by dmc_load_program(). Unlike the MMIO address table, the firmware load address is not validated. Add a sanity check to ensure it is within the valid range. BSpec: 69671, 68378 (cherry picked from commit 5e47ee5c76ca9becde8df4ad5202845b7ffcbc4c)
    Severity
    No CVSS data available.
    Assigner
    Linux CNA
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 3d5928a168a9546b23c6b3439c6158d7a028326c , < fe48b4c48d4131192a10bc6ea526a8a36b345501 (git)
    Affected: 3d5928a168a9546b23c6b3439c6158d7a028326c , < ef82b4d5cb4a3fe77c7f99008d78b8c64709e258 (git)
    Affected: 3d5928a168a9546b23c6b3439c6158d7a028326c , < 2fbd099b4e7c8c4ff70033c5bb950cdbb20838e2 (git)
    Affected: 3d5928a168a9546b23c6b3439c6158d7a028326c , < 7dedc5bb11f95e96fe80757c924d8d9aa7327759 (git)
    		Create a notification for this product.
    Linux Linux Affected: 5.15
    Unaffected: 0 , < 5.15 (semver)
    Unaffected: 6.12.117 , ≤ 6.12.* (semver)
    Unaffected: 6.18.59 , ≤ 6.18.* (semver)
    Unaffected: 7.2.13 , ≤ 7.2.* (semver)
    Unaffected: 7.3 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/display/intel_dmc.c",
            "drivers/gpu/drm/i915/display/intel_dmc_regs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fe48b4c48d4131192a10bc6ea526a8a36b345501",
              "status": "affected",
              "version": "3d5928a168a9546b23c6b3439c6158d7a028326c",
              "versionType": "git"
            },
            {
              "lessThan": "ef82b4d5cb4a3fe77c7f99008d78b8c64709e258",
              "status": "affected",
              "version": "3d5928a168a9546b23c6b3439c6158d7a028326c",
              "versionType": "git"
            },
            {
              "lessThan": "2fbd099b4e7c8c4ff70033c5bb950cdbb20838e2",
              "status": "affected",
              "version": "3d5928a168a9546b23c6b3439c6158d7a028326c",
              "versionType": "git"
            },
            {
              "lessThan": "7dedc5bb11f95e96fe80757c924d8d9aa7327759",
              "status": "affected",
              "version": "3d5928a168a9546b23c6b3439c6158d7a028326c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/display/intel_dmc.c",
            "drivers/gpu/drm/i915/display/intel_dmc_regs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.117",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.59",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.13",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/dmc: Add sanity check for DMC load address\n\nFor DMC firmware header version 3, the firmware load address is stored\nin dmc_info-\u003estart_mmioaddr and later used by dmc_load_program().\n\nUnlike the MMIO address table, the firmware load address is not\nvalidated. Add a sanity check to ensure it is within the valid range.\n\nBSpec: 69671, 68378\n(cherry picked from commit 5e47ee5c76ca9becde8df4ad5202845b7ffcbc4c)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:15:25.826Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fe48b4c48d4131192a10bc6ea526a8a36b345501"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef82b4d5cb4a3fe77c7f99008d78b8c64709e258"
        },
        {
          "url": "https://git.kernel.org/stable/c/2fbd099b4e7c8c4ff70033c5bb950cdbb20838e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/7dedc5bb11f95e96fe80757c924d8d9aa7327759"
        }
      ],
      "title": "drm/i915/dmc: Add sanity check for DMC load address",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99146",
    "datePublished": "2026-10-28T10:35:02.847Z",
    "dateReserved": "2026-09-25T10:25:14.396Z",
    "dateUpdated": "2026-11-10T18:15:25.826Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-99122 (GCVE-0-2026-99122)

    Vulnerability from cvelistv5 – Published: 2026-10-28 10:34 – Updated: 2026-11-10 18:15
    VLAI
    Title
    vsock/vmci: validate packet source for connected sockets
    Summary
    In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: validate packet source for connected sockets vmci_transport_recv_stream_cb() looks up sockets first by the full source and destination tuple, then by destination only in the bound table. The fallback can select a non-listening socket without checking whether the packet came from its stored peer. This was reproduced with two VMCI contexts. A RST from the context not stored in a TCP_SYN_SENT socket reset that socket after it was selected by the destination-only lookup. VMCI can process notification packets in bottom-half context when the socket is not owned by user context, or defer packets to a workqueue. Use vsock_check_source() after taking the socket lock in the bottom-half path, and recheck after lock_sock() in the workqueue path. Listening sockets continue to accept packets from any source. Reply with a RST addressed from the received packet before dropping a source that fails validation. This preserves the existing reset behavior for bound non-listening and concurrently closed sockets without directing the reset to a connected socket's stored peer.
    Severity
    7.3 (High)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H
    Assigner
    Linux CNA
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: d021c344051af91f42c5ba9fdedc176740cbd238 , < cdd1f99eaa4d4db82d506eb50e724460671c7cac (git)
    Affected: d021c344051af91f42c5ba9fdedc176740cbd238 , < c027f8b429dbb2157fc1b503df196e272d947c89 (git)
    Affected: d021c344051af91f42c5ba9fdedc176740cbd238 , < 90c423b62ec9be08177f74b07a47937ca8d2035b (git)
    Affected: d021c344051af91f42c5ba9fdedc176740cbd238 , < ad9a7da3fa39c2d616ec0dd3cf6e30531d032fe7 (git)
    		Create a notification for this product.
    Linux Linux Affected: 3.9
    Unaffected: 0 , < 3.9 (semver)
    Unaffected: 6.12.117 , ≤ 6.12.* (semver)
    Unaffected: 6.18.59 , ≤ 6.18.* (semver)
    Unaffected: 7.2.13 , ≤ 7.2.* (semver)
    Unaffected: 7.3 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/vmw_vsock/vmci_transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cdd1f99eaa4d4db82d506eb50e724460671c7cac",
              "status": "affected",
              "version": "d021c344051af91f42c5ba9fdedc176740cbd238",
              "versionType": "git"
            },
            {
              "lessThan": "c027f8b429dbb2157fc1b503df196e272d947c89",
              "status": "affected",
              "version": "d021c344051af91f42c5ba9fdedc176740cbd238",
              "versionType": "git"
            },
            {
              "lessThan": "90c423b62ec9be08177f74b07a47937ca8d2035b",
              "status": "affected",
              "version": "d021c344051af91f42c5ba9fdedc176740cbd238",
              "versionType": "git"
            },
            {
              "lessThan": "ad9a7da3fa39c2d616ec0dd3cf6e30531d032fe7",
              "status": "affected",
              "version": "d021c344051af91f42c5ba9fdedc176740cbd238",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/vmw_vsock/vmci_transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.9"
            },
            {
              "lessThan": "3.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.117",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.59",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.13",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "3.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/vmci: validate packet source for connected sockets\n\nvmci_transport_recv_stream_cb() looks up sockets first by the full source\nand destination tuple, then by destination only in the bound table. The\nfallback can select a non-listening socket without checking whether the\npacket came from its stored peer.\n\nThis was reproduced with two VMCI contexts. A RST from the context not\nstored in a TCP_SYN_SENT socket reset that socket after it was selected by\nthe destination-only lookup.\n\nVMCI can process notification packets in bottom-half context when the\nsocket is not owned by user context, or defer packets to a workqueue. Use\nvsock_check_source() after taking the socket lock in the bottom-half path,\nand recheck after lock_sock() in the workqueue path. Listening sockets\ncontinue to accept packets from any source.\n\nReply with a RST addressed from the received packet before dropping a\nsource that fails validation. This preserves the existing reset behavior\nfor bound non-listening and concurrently closed sockets without directing\nthe reset to a connected socket\u0027s stored peer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - A local VMCI endpoint supplies the forged control datagram through IOCTL_VMCI_DATAGRAM_SEND, reaching vmci_datagram_dispatch() and the patched vmci_transport_recv_stream_cb(); vsock is therefore Local rather than a routable network vector.\nAC:L - vsock_diag_dump() exposes socket CIDs, ports, and state without an authorization check, after which a chosen RST deterministically misses vsock_find_connected_socket() and reaches the victim through vsock_find_bound_socket(); no race or uncontrolled condition is required.\nPR:L - vmci_host_open(), IOCTL_VMCI_INIT_CONTEXT, and IOCTL_VMCI_DATAGRAM_SEND contain no capability check, allowing a low-privilege VMX/local process with ordinary VMCI-device access to create an unrestricted context and submit the packet.\nUI:N - After the victim process has an ordinary bound connecting or established socket, the attacker\u0027s datagram alone drives vmci_transport_recv_pkt_work() and the reset handler; no victim user action is required.\nS:C - A packet owned by an attacker-controlled guest/VMX VMCI context is applied to a host-context socket by vmci_transport_recv_connecting_client() or vmci_transport_recv_connected(), crossing the VMCI virtualization or VMM-sandbox boundary.\nC:L - On an established socket, a forged WAITING_READ reaches vmci_transport_handle_waiting_read(), which conditionally returns WROTE to the foreign source based on vmci_qpair_produce_buf_ready(); this exposes limited queue-occupancy and traffic-state information, not payload bytes.\nI:N - The demonstrated RST and forged notification paths do not write application payloads, alter the intended VMCI queue pair, or corrupt memory; their changes to sk_state, peer_shutdown, and notification flags implement connection disruption rather than data modification.\nA:H - vmci_transport_recv_connecting_client() sets TCP_CLOSE and ECONNRESET, while vmci_transport_recv_connected() sets SOCK_DONE, SHUTDOWN_MASK, and TCP_CLOSING. Because tuples can be re-enumerated and RST injection repeated, the attacker can continuously terminate targeted VMCI client connections and fully deny their service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:15:25.472Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cdd1f99eaa4d4db82d506eb50e724460671c7cac"
        },
        {
          "url": "https://git.kernel.org/stable/c/c027f8b429dbb2157fc1b503df196e272d947c89"
        },
        {
          "url": "https://git.kernel.org/stable/c/90c423b62ec9be08177f74b07a47937ca8d2035b"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad9a7da3fa39c2d616ec0dd3cf6e30531d032fe7"
        }
      ],
      "title": "vsock/vmci: validate packet source for connected sockets",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99122",
    "datePublished": "2026-10-28T10:34:37.859Z",
    "dateReserved": "2026-09-25T10:25:14.393Z",
    "dateUpdated": "2026-11-10T18:15:25.472Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-99109 (GCVE-0-2026-99109)

    Vulnerability from cvelistv5 – Published: 2026-10-28 10:34 – Updated: 2026-11-10 18:15
    VLAI
    Title
    smb: client: reject SetEA requests that do not fit the request buffer
    Summary
    In the Linux kernel, the following vulnerability has been resolved: smb: client: reject SetEA requests that do not fit the request buffer CIFSSMBSetEA() copies the caller's extended attribute value into the SMB request buffer without checking that it fits. The requirement is stated in the source but was never implemented: /*BB add length check to see if it would fit in negotiated SMB buffer size BB */ /* if (ea_value_len > buffer_size - 512 (enough for header)) */ if (ea_value_len) memcpy(parm_data->list.name + name_len + 1, ea_value, ea_value_len); The only bound applied on the way in is in cifs_xattr_set(): #define MAX_EA_VALUE_SIZE CIFSMaxBufSize ... if (size > MAX_EA_VALUE_SIZE) CIFSMaxBufSize is the full payload capacity of the buffer, so a value of exactly that size leaves no room for the SMB header, the TRANS2 parameter block, the fealist header and the EA name that are written ahead of it in the same object. SendReceive() already enforces the correct limit on this very length: if (in_len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE) but it is called after the copy has taken place. An unprivileged setxattr(2) on an SMB1 mount with a 250-byte name and a 16384-byte value writes 16384 bytes starting 345 bytes into a 16588-byte cifs_request object, ending 141 bytes past it: BUG: KASAN: slab-out-of-bounds in CIFSSMBSetEA+0xabc/0xde0 Write of size 16384 at addr ffff888003aa0159 by task init/68 __asan_memcpy+0x3c/0x60 CIFSSMBSetEA+0xabc/0xde0 cifs_xattr_set+0xd3a/0xff0 __vfs_setxattr+0x13e/0x1a0 The buggy address is located 345 bytes inside of allocated 16588-byte region Apply SendReceive()'s limit to the assembled request before the copy rather than after it, and widen the byte counters so the sum cannot wrap before it is tested. byte_count is also tested against U16_MAX, because it is stored in the 16-bit pSMB->ByteCount. That becomes reachable when CIFSMaxBufSize is raised at module load, where it may be set as high as 1024*127: with a 5-byte EA name and a 65521-byte value, count is exactly U16_MAX while byte_count is 65556, and cpu_to_le16() would truncate it to 20 and transmit a frame whose ByteCount does not match its length. Testing byte_count covers count as well, since byte_count is the larger of the two and count's only 16-bit consumer is written after this point. check_add_overflow() is evaluated first so that total_len is assigned before it is reported.
    Severity
    7.8 (High)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    Assigner
    Linux CNA
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < bc737f5f5cc3fcd10bd919527cacc0efd703c30b (git)
    Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 79345a5d14b851e9ed28d3a9fe53301661dbcf11 (git)
    Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 9efbd764ab80fa86d2258550877a74d78a25e855 (git)
    Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 4aa2c106aef4bf3dfd97c30842db0767b26e8428 (git)
    		Create a notification for this product.
    Linux Linux Affected: 2.6.12
    Unaffected: 0 , < 2.6.12 (semver)
    Unaffected: 6.12.117 , ≤ 6.12.* (semver)
    Unaffected: 6.18.61 , ≤ 6.18.* (semver)
    Unaffected: 7.2.13 , ≤ 7.2.* (semver)
    Unaffected: 7.3 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cifssmb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bc737f5f5cc3fcd10bd919527cacc0efd703c30b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "79345a5d14b851e9ed28d3a9fe53301661dbcf11",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "9efbd764ab80fa86d2258550877a74d78a25e855",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "4aa2c106aef4bf3dfd97c30842db0767b26e8428",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cifssmb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.117",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.61",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.13",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: reject SetEA requests that do not fit the request buffer\n\nCIFSSMBSetEA() copies the caller\u0027s extended attribute value into the\nSMB request buffer without checking that it fits.  The requirement is\nstated in the source but was never implemented:\n\n\t/*BB add length check to see if it would fit in\n\t     negotiated SMB buffer size BB */\n\t/* if (ea_value_len \u003e buffer_size - 512 (enough for header)) */\n\tif (ea_value_len)\n\t\tmemcpy(parm_data-\u003elist.name + name_len + 1,\n\t\t       ea_value, ea_value_len);\n\nThe only bound applied on the way in is in cifs_xattr_set():\n\n\t#define MAX_EA_VALUE_SIZE CIFSMaxBufSize\n\t...\n\tif (size \u003e MAX_EA_VALUE_SIZE)\n\nCIFSMaxBufSize is the full payload capacity of the buffer, so a value\nof exactly that size leaves no room for the SMB header, the TRANS2\nparameter block, the fealist header and the EA name that are written\nahead of it in the same object.\n\nSendReceive() already enforces the correct limit on this very length:\n\n\tif (in_len \u003e CIFSMaxBufSize + MAX_CIFS_HDR_SIZE)\n\nbut it is called after the copy has taken place.  An unprivileged\nsetxattr(2) on an SMB1 mount with a 250-byte name and a 16384-byte\nvalue writes 16384 bytes starting 345 bytes into a 16588-byte\ncifs_request object, ending 141 bytes past it:\n\n  BUG: KASAN: slab-out-of-bounds in CIFSSMBSetEA+0xabc/0xde0\n  Write of size 16384 at addr ffff888003aa0159 by task init/68\n   __asan_memcpy+0x3c/0x60\n   CIFSSMBSetEA+0xabc/0xde0\n   cifs_xattr_set+0xd3a/0xff0\n   __vfs_setxattr+0x13e/0x1a0\n  The buggy address is located 345 bytes inside of\n   allocated 16588-byte region\n\nApply SendReceive()\u0027s limit to the assembled request before the copy\nrather than after it, and widen the byte counters so the sum cannot\nwrap before it is tested.\n\nbyte_count is also tested against U16_MAX, because it is stored in the\n16-bit pSMB-\u003eByteCount.  That becomes reachable when CIFSMaxBufSize is\nraised at module load, where it may be set as high as 1024*127: with a\n5-byte EA name and a 65521-byte value, count is exactly U16_MAX while\nbyte_count is 65556, and cpu_to_le16() would truncate it to 20 and\ntransmit a frame whose ByteCount does not match its length.  Testing\nbyte_count covers count as well, since byte_count is the larger of the\ntwo and count\u0027s only 16-bit consumer is written after this point.\n\ncheck_add_overflow() is evaluated first so that total_len is assigned\nbefore it is reported."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker-controlled bytes originate in setxattr(2): path_setxattrat() copies the local value, then cifs_xattr_set() calls SMB1\u0027s CIFSSMBSetEA(), whose memcpy overflows the request before any SMB response is processed.\nAC:L - On an existing vers=1.0 mount, the caller can deterministically choose a user.* suffix up to 250 bytes and a value up to CIFSMaxBufSize; CIFSSMBSetEA() performs the oversized memcpy before SendReceive() checks in_len, with no race or server-controlled condition.\nPR:L - vfs_setxattr() calls xattr_permission() with MAY_WRITE, and a user.* attribute requires only write permission on the CIFS inode; although creating the mount requires init-namespace CAP_SYS_ADMIN, exploiting an existing writable mount requires no capability.\nUI:N - The attacker invokes setxattr(2) themselves on a writable file in the already-mounted share; no other user must open a file, approve a prompt, or perform a mount during exploitation.\nS:U - The overwrite occurs in the client kernel\u0027s cifs_request allocation returned by cifs_buf_get() and affects that same kernel security authority, without crossing a VM, IOMMU, or sandbox boundary.\nC:H - CIFSSMBSetEA() copies attacker-chosen ea_value bytes beyond the cifs_request object; grooming concurrent allocations can turn corruption of adjacent request or allocator state into control-flow execution and arbitrary kernel-memory disclosure.\nI:H - The vulnerable memcpy provides a contiguous attacker-controlled heap overwrite; the reproduced 16384-byte copy starts at offset 345 and ends 141 bytes beyond the 16588-byte cifs_request, enabling adjacent-object corruption and control-flow hijacking.\nA:H - The reproduced setxattr(2) triggers a KASAN slab-out-of-bounds fault in CIFSSMBSetEA(); hitting guarded memory or corrupting request or allocator state can oops or panic the kernel, and the caller can repeat the syscall."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:15:24.796Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bc737f5f5cc3fcd10bd919527cacc0efd703c30b"
        },
        {
          "url": "https://git.kernel.org/stable/c/79345a5d14b851e9ed28d3a9fe53301661dbcf11"
        },
        {
          "url": "https://git.kernel.org/stable/c/9efbd764ab80fa86d2258550877a74d78a25e855"
        },
        {
          "url": "https://git.kernel.org/stable/c/4aa2c106aef4bf3dfd97c30842db0767b26e8428"
        }
      ],
      "title": "smb: client: reject SetEA requests that do not fit the request buffer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99109",
    "datePublished": "2026-10-28T10:34:27.507Z",
    "dateReserved": "2026-09-25T10:25:14.391Z",
    "dateUpdated": "2026-11-10T18:15:24.796Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-99087 (GCVE-0-2026-99087)

    Vulnerability from cvelistv5 – Published: 2026-10-23 12:45 – Updated: 2026-11-10 18:15
    VLAI
    Title
    dm-integrity: fix NULL pointer dereference when the 'R' flag is used
    Summary
    In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix NULL pointer dereference when the 'R' flag is used If the dm-integrity device has the SB_FLAG_DIRTY_BITMAP flag set and the user activates the device in the 'R' mode, a crash in dm_integrity_resume happens because the function attempts to read the journal containing the bitmap. This patch makes dm-integrity skip any writes to the device in dm_integrity_resume if the device is activated in the 'R' mode.
    Severity
    No CVSS data available.
    Assigner
    Linux CNA
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 468dfca38b1a6fbdccd195d875599cb7c8875cd9 , < 73e5b7b14df0430ef2135e9bd9fa3f5b253ef789 (git)
    Affected: 468dfca38b1a6fbdccd195d875599cb7c8875cd9 , < 2e25842f0e4423e0efb243f56153d842ed6b933f (git)
    Affected: 468dfca38b1a6fbdccd195d875599cb7c8875cd9 , < 69ed43ed8a174465fca1ba6bfbde53e4618c8956 (git)
    Affected: 468dfca38b1a6fbdccd195d875599cb7c8875cd9 , < 7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84 (git)
    		Create a notification for this product.
    Linux Linux Affected: 5.2
    Unaffected: 0 , < 5.2 (semver)
    Unaffected: 6.12.117 , ≤ 6.12.* (semver)
    Unaffected: 6.18.58 , ≤ 6.18.* (semver)
    Unaffected: 7.2.12 , ≤ 7.2.* (semver)
    Unaffected: 7.3 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-integrity.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "73e5b7b14df0430ef2135e9bd9fa3f5b253ef789",
              "status": "affected",
              "version": "468dfca38b1a6fbdccd195d875599cb7c8875cd9",
              "versionType": "git"
            },
            {
              "lessThan": "2e25842f0e4423e0efb243f56153d842ed6b933f",
              "status": "affected",
              "version": "468dfca38b1a6fbdccd195d875599cb7c8875cd9",
              "versionType": "git"
            },
            {
              "lessThan": "69ed43ed8a174465fca1ba6bfbde53e4618c8956",
              "status": "affected",
              "version": "468dfca38b1a6fbdccd195d875599cb7c8875cd9",
              "versionType": "git"
            },
            {
              "lessThan": "7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84",
              "status": "affected",
              "version": "468dfca38b1a6fbdccd195d875599cb7c8875cd9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-integrity.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.117",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.58",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.12",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: fix NULL pointer dereference when the \u0027R\u0027 flag is used\n\nIf the dm-integrity device has the SB_FLAG_DIRTY_BITMAP flag set and the\nuser activates the device in the \u0027R\u0027 mode, a crash in dm_integrity_resume\nhappens because the function attempts to read the journal containing the\nbitmap.\n\nThis patch makes dm-integrity skip any writes to the device in\ndm_integrity_resume if the device is activated in the \u0027R\u0027 mode."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:15:24.425Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/73e5b7b14df0430ef2135e9bd9fa3f5b253ef789"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e25842f0e4423e0efb243f56153d842ed6b933f"
        },
        {
          "url": "https://git.kernel.org/stable/c/69ed43ed8a174465fca1ba6bfbde53e4618c8956"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84"
        }
      ],
      "title": "dm-integrity: fix NULL pointer dereference when the \u0027R\u0027 flag is used",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99087",
    "datePublished": "2026-10-23T12:45:05.714Z",
    "dateReserved": "2026-09-25T10:25:14.390Z",
    "dateUpdated": "2026-11-10T18:15:24.425Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-99086 (GCVE-0-2026-99086)

    Vulnerability from cvelistv5 – Published: 2026-10-23 12:45 – Updated: 2026-11-10 18:15
    VLAI
    Title
    dm-integrity: validate the superblock on resume
    Summary
    In the Linux kernel, the following vulnerability has been resolved: dm-integrity: validate the superblock on resume dm_integrity_resume() re-reads the superblock from the device so that it picks up the flags and the recalculate position. It performs no validation on the result, while the constructor validates the superblock it reads and sizes all the in-memory structures according to it. The user may modify the superblock on the underlying device while the dm-integrity device is suspended, so that the two no longer agree. In particular, access_journal_data() shifts the journal entry index by ic->sb->log2_sectors_per_block, while ic->journal_section_sectors and the journal page list were computed with the value that was present at constructor time. Increasing log2_sectors_per_block makes the index run past the end of the journal, and dm-integrity then writes 512 bytes through lowmem_page_address(NULL). Snapshot the validated superblock in the constructor and refuse to resume if any of the fields that describe the on-disk geometry changed.
    Severity
    No CVSS data available.
    Assigner
    Linux CNA
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: c6138af1f5454c2631a837916fda958ea72c0d71 , < 0499b6d1c9d4477d6538b88c30f9d0c1a28b3e75 (git)
    Affected: 38625191f32f77a9d5fc7cc15f4f9b78768bfb33 , < 454b67fcc28c18502e47dfb9f067b04c28628ada (git)
    Affected: 118ba36e446c01e3cd34b3eedabf1d9436525e1d , < e9ec5cbbaf4dd3a02ae3d81719f4fcb9b609aa8e (git)
    Affected: 118ba36e446c01e3cd34b3eedabf1d9436525e1d , < fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2 (git)
    Affected: 824b9c27d7b600520b95f0cab95a47d1b08a9483 (git)
    Affected: fb49f209995f729053c6ee728436f98d78a49b6f (git)
    Affected: 3ff70e2e31c419e2230d0c66cb2bfb3b1b414b7f (git)
    Affected: 6.12.75 , < 6.12.117 (semver)
    Affected: 6.18.16 , < 6.18.58 (semver)
    Affected: 6.1.165 , < 6.2 (semver)
    Affected: 6.6.128 , < 6.7 (semver)
    Affected: 6.19.6 , < 6.20 (semver)
    		Create a notification for this product.
    Linux Linux Affected: 7.0
    Unaffected: 0 , < 7.0 (semver)
    Unaffected: 6.12.117 , ≤ 6.12.* (semver)
    Unaffected: 6.18.58 , ≤ 6.18.* (semver)
    Unaffected: 7.2.12 , ≤ 7.2.* (semver)
    Unaffected: 7.3 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-integrity.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0499b6d1c9d4477d6538b88c30f9d0c1a28b3e75",
              "status": "affected",
              "version": "c6138af1f5454c2631a837916fda958ea72c0d71",
              "versionType": "git"
            },
            {
              "lessThan": "454b67fcc28c18502e47dfb9f067b04c28628ada",
              "status": "affected",
              "version": "38625191f32f77a9d5fc7cc15f4f9b78768bfb33",
              "versionType": "git"
            },
            {
              "lessThan": "e9ec5cbbaf4dd3a02ae3d81719f4fcb9b609aa8e",
              "status": "affected",
              "version": "118ba36e446c01e3cd34b3eedabf1d9436525e1d",
              "versionType": "git"
            },
            {
              "lessThan": "fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2",
              "status": "affected",
              "version": "118ba36e446c01e3cd34b3eedabf1d9436525e1d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "824b9c27d7b600520b95f0cab95a47d1b08a9483",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "fb49f209995f729053c6ee728436f98d78a49b6f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3ff70e2e31c419e2230d0c66cb2bfb3b1b414b7f",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.117",
              "status": "affected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.58",
              "status": "affected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThan": "6.20",
              "status": "affected",
              "version": "6.19.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-integrity.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.117",
                  "versionStartIncluding": "6.12.75",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.58",
                  "versionStartIncluding": "6.18.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.12",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.165",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.128",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.19.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-integrity: validate the superblock on resume\n\ndm_integrity_resume() re-reads the superblock from the device so that it\npicks up the flags and the recalculate position. It performs no\nvalidation on the result, while the constructor validates the superblock\nit reads and sizes all the in-memory structures according to it. The user\nmay modify the superblock on the underlying device while the dm-integrity\ndevice is suspended, so that the two no longer agree.\n\nIn particular, access_journal_data() shifts the journal entry index by\nic-\u003esb-\u003elog2_sectors_per_block, while ic-\u003ejournal_section_sectors and the\njournal page list were computed with the value that was present at\nconstructor time. Increasing log2_sectors_per_block makes the index run\npast the end of the journal, and dm-integrity then writes 512 bytes\nthrough lowmem_page_address(NULL).\n\nSnapshot the validated superblock in the constructor and refuse to resume\nif any of the fields that describe the on-disk geometry changed."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:15:23.819Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0499b6d1c9d4477d6538b88c30f9d0c1a28b3e75"
        },
        {
          "url": "https://git.kernel.org/stable/c/454b67fcc28c18502e47dfb9f067b04c28628ada"
        },
        {
          "url": "https://git.kernel.org/stable/c/e9ec5cbbaf4dd3a02ae3d81719f4fcb9b609aa8e"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2"
        }
      ],
      "title": "dm-integrity: validate the superblock on resume",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99086",
    "datePublished": "2026-10-23T12:45:04.496Z",
    "dateReserved": "2026-09-25T10:25:14.390Z",
    "dateUpdated": "2026-11-10T18:15:23.819Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-99076 (GCVE-0-2026-99076)

    Vulnerability from cvelistv5 – Published: 2026-10-23 12:23 – Updated: 2026-11-10 18:15
    VLAI
    Title
    ipv6: udp: Create exceptions before socket matching
    Summary
    In the Linux kernel, the following vulnerability has been resolved: ipv6: udp: Create exceptions before socket matching Currently, when ICMPv6 Packet Too Big and Redirect Message packets are locally delivered and quote a UDP packet, an exception is only created in the IPv6 exception cache if the kernel can match the UDP packet to an existing socket. This behavior allows off-path attackers to conduct a side-channel attack on the exception cache in order to discover the ephemeral port used by a connected UDP socket. Commit 4785305c05b2 ("ipv6: use siphash in rt6_exception_hash()") and commit a00df2caffed ("ipv6: make exception cache less predictible") tried to mitigate such attacks by making it harder for attackers to discover hash collisions in the exception cache and by randomizing the number of exceptions a hash bucket can hold, respectively. Unfortunately, both of the mitigations can be bypassed. Instead, mitigate such attacks by always creating an exception, even before trying to find a matching socket. Do that by calling ip6_update_pmtu() and ip6_redirect(), the helpers used when the quoted packet did not originate from a socket. This means that guesses (right or wrong) from an off-path attacker will always result in an exception being created or updated in the cache that the attacker can observe. Pass the ifindex of the ingress device and the default uid, in a similar fashion to icmpv6_err(). Unlike IPv4, an oif of 0 would not match any nexthop in ip6_redirect_nh_match() and no exception would be created in response to a Redirect Message. Note that this does not allow attackers to create exceptions that they could not create before, as both helpers can already be reached with little to no validation. For example, by sending an ICMPv6 error that quotes an ICMPv6 Echo Reply or one that quotes a UDP source port that matches a wildcard socket. Also note that in the good case (matched socket) the above scheme comes at the cost of an extra route lookup, as the no socket helpers perform their own lookup before the one performed by ip6_sk_update_pmtu() / ip6_sk_redirect(). When the two resolve to different nexthops, it also results in two exceptions being created for the same destination IP. One in the exception cache of the nexthop resolved by the no socket helpers and another in the exception cache of the nexthop used by the socket.
    Severity
    No CVSS data available.
    Assigner
    Linux CNA
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 2b760fcf5cfb34e8610df56d83745b2b74ae1379 , < 9b88f0fcbd4b746de0478b4fd99fa495eb26b857 (git)
    Affected: 2b760fcf5cfb34e8610df56d83745b2b74ae1379 , < fc1fc874ceed4db566a5efbff39313d3d91d424a (git)
    Affected: 2b760fcf5cfb34e8610df56d83745b2b74ae1379 , < 8c9b310c958be33ba8fb9d0e6b77811d013e10c0 (git)
    Affected: 2b760fcf5cfb34e8610df56d83745b2b74ae1379 , < ac76cab50e899a7346408b8d3c3a4192c2eefb9f (git)
    		Create a notification for this product.
    Linux Linux Affected: 4.15
    Unaffected: 0 , < 4.15 (semver)
    Unaffected: 6.12.117 , ≤ 6.12.* (semver)
    Unaffected: 6.18.61 , ≤ 6.18.* (semver)
    Unaffected: 7.2.11 , ≤ 7.2.* (semver)
    Unaffected: 7.3 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/udp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9b88f0fcbd4b746de0478b4fd99fa495eb26b857",
              "status": "affected",
              "version": "2b760fcf5cfb34e8610df56d83745b2b74ae1379",
              "versionType": "git"
            },
            {
              "lessThan": "fc1fc874ceed4db566a5efbff39313d3d91d424a",
              "status": "affected",
              "version": "2b760fcf5cfb34e8610df56d83745b2b74ae1379",
              "versionType": "git"
            },
            {
              "lessThan": "8c9b310c958be33ba8fb9d0e6b77811d013e10c0",
              "status": "affected",
              "version": "2b760fcf5cfb34e8610df56d83745b2b74ae1379",
              "versionType": "git"
            },
            {
              "lessThan": "ac76cab50e899a7346408b8d3c3a4192c2eefb9f",
              "status": "affected",
              "version": "2b760fcf5cfb34e8610df56d83745b2b74ae1379",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/udp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.117",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.61",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.11",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: udp: Create exceptions before socket matching\n\nCurrently, when ICMPv6 Packet Too Big and Redirect Message packets are\nlocally delivered and quote a UDP packet, an exception is only created\nin the IPv6 exception cache if the kernel can match the UDP packet to an\nexisting socket.\n\nThis behavior allows off-path attackers to conduct a side-channel attack\non the exception cache in order to discover the ephemeral port used by a\nconnected UDP socket.\n\nCommit 4785305c05b2 (\"ipv6: use siphash in rt6_exception_hash()\") and\ncommit a00df2caffed (\"ipv6: make exception cache less predictible\") tried\nto mitigate such attacks by making it harder for attackers to discover\nhash collisions in the exception cache and by randomizing the number of\nexceptions a hash bucket can hold, respectively. Unfortunately, both of\nthe mitigations can be bypassed.\n\nInstead, mitigate such attacks by always creating an exception, even\nbefore trying to find a matching socket. Do that by calling\nip6_update_pmtu() and ip6_redirect(), the helpers used when the quoted\npacket did not originate from a socket.\n\nThis means that guesses (right or wrong) from an off-path attacker will\nalways result in an exception being created or updated in the cache that\nthe attacker can observe.\n\nPass the ifindex of the ingress device and the default uid, in a similar\nfashion to icmpv6_err(). Unlike IPv4, an oif of 0 would not match any\nnexthop in ip6_redirect_nh_match() and no exception would be created in\nresponse to a Redirect Message.\n\nNote that this does not allow attackers to create exceptions that they\ncould not create before, as both helpers can already be reached with\nlittle to no validation. For example, by sending an ICMPv6 error that\nquotes an ICMPv6 Echo Reply or one that quotes a UDP source port that\nmatches a wildcard socket.\n\nAlso note that in the good case (matched socket) the above scheme comes\nat the cost of an extra route lookup, as the no socket helpers perform\ntheir own lookup before the one performed by ip6_sk_update_pmtu() /\nip6_sk_redirect(). When the two resolve to different nexthops, it also\nresults in two exceptions being created for the same destination IP. One\nin the exception cache of the nexthop resolved by the no socket helpers\nand another in the exception cache of the nexthop used by the socket."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:15:23.412Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9b88f0fcbd4b746de0478b4fd99fa495eb26b857"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc1fc874ceed4db566a5efbff39313d3d91d424a"
        },
        {
          "url": "https://git.kernel.org/stable/c/8c9b310c958be33ba8fb9d0e6b77811d013e10c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac76cab50e899a7346408b8d3c3a4192c2eefb9f"
        }
      ],
      "title": "ipv6: udp: Create exceptions before socket matching",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99076",
    "datePublished": "2026-10-23T12:23:19.727Z",
    "dateReserved": "2026-09-25T10:25:14.389Z",
    "dateUpdated": "2026-11-10T18:15:23.412Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-99026 (GCVE-0-2026-99026)

    Vulnerability from cvelistv5 – Published: 2026-10-23 12:21 – Updated: 2026-11-10 18:15
    VLAI
    Title
    net: team: free skb when broadcast has no txable port
    Summary
    In the Linux kernel, the following vulnerability has been resolved: net: team: free skb when broadcast has no txable port bc_transmit() sends the original skb through the last txable port. When no port is txable, it returns false without consuming the skb, but team_xmit() still returns NETDEV_TX_OK. AF_PACKET sends then retain the skb and its socket write-memory charge. A TX-enabled, link-down port keeps the broadcast transmit op installed. Carrier can stay up through a second link-up, TX-disabled port or be forced on by userspace. Free the original skb on the no-port path while leaving the existing drop accounting intact. Discovered by Sashiko during review of previous commit.
    Severity
    No CVSS data available.
    Assigner
    Linux CNA
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 5fc889911a99043a97da1daa0d010ad72cbc3042 , < aec1d35d76ad883bae83c24707010115f38d02ac (git)
    Affected: 5fc889911a99043a97da1daa0d010ad72cbc3042 , < 961563117626f4681623077ec0cfd86f86da0d49 (git)
    Affected: 5fc889911a99043a97da1daa0d010ad72cbc3042 , < f34b1bcac4581a5bd3daf9eff90f175e736b54aa (git)
    Affected: 5fc889911a99043a97da1daa0d010ad72cbc3042 , < 489114c9ecae44e523361a4b3e610ee5ebd9189c (git)
    		Create a notification for this product.
    Linux Linux Affected: 3.6
    Unaffected: 0 , < 3.6 (semver)
    Unaffected: 6.12.117 , ≤ 6.12.* (semver)
    Unaffected: 6.18.57 , ≤ 6.18.* (semver)
    Unaffected: 7.2.11 , ≤ 7.2.* (semver)
    Unaffected: 7.3 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/team/team_mode_broadcast.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "aec1d35d76ad883bae83c24707010115f38d02ac",
              "status": "affected",
              "version": "5fc889911a99043a97da1daa0d010ad72cbc3042",
              "versionType": "git"
            },
            {
              "lessThan": "961563117626f4681623077ec0cfd86f86da0d49",
              "status": "affected",
              "version": "5fc889911a99043a97da1daa0d010ad72cbc3042",
              "versionType": "git"
            },
            {
              "lessThan": "f34b1bcac4581a5bd3daf9eff90f175e736b54aa",
              "status": "affected",
              "version": "5fc889911a99043a97da1daa0d010ad72cbc3042",
              "versionType": "git"
            },
            {
              "lessThan": "489114c9ecae44e523361a4b3e610ee5ebd9189c",
              "status": "affected",
              "version": "5fc889911a99043a97da1daa0d010ad72cbc3042",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/team/team_mode_broadcast.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.6"
            },
            {
              "lessThan": "3.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.117",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.11",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: team: free skb when broadcast has no txable port\n\nbc_transmit() sends the original skb through the last txable port.\nWhen no port is txable, it returns false without consuming the skb, but\nteam_xmit() still returns NETDEV_TX_OK. AF_PACKET sends then retain the\nskb and its socket write-memory charge.\n\nA TX-enabled, link-down port keeps the broadcast transmit op installed.\nCarrier can stay up through a second link-up, TX-disabled port or be\nforced on by userspace. Free the original skb on the no-port path while\nleaving the existing drop accounting intact.\n\nDiscovered by Sashiko during review of previous commit."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:15:22.929Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/aec1d35d76ad883bae83c24707010115f38d02ac"
        },
        {
          "url": "https://git.kernel.org/stable/c/961563117626f4681623077ec0cfd86f86da0d49"
        },
        {
          "url": "https://git.kernel.org/stable/c/f34b1bcac4581a5bd3daf9eff90f175e736b54aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/489114c9ecae44e523361a4b3e610ee5ebd9189c"
        }
      ],
      "title": "net: team: free skb when broadcast has no txable port",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99026",
    "datePublished": "2026-10-23T12:21:13.509Z",
    "dateReserved": "2026-09-25T10:25:14.386Z",
    "dateUpdated": "2026-11-10T18:15:22.929Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-99021 (GCVE-0-2026-99021)

    Vulnerability from cvelistv5 – Published: 2026-10-23 12:21 – Updated: 2026-11-10 18:15
    VLAI
    Title
    regulator: of: fill in supply names in of_regulator_bulk_get_all()
    Summary
    In the Linux kernel, the following vulnerability has been resolved: regulator: of: fill in supply names in of_regulator_bulk_get_all() of_regulator_bulk_get_all() returns an array it allocated itself, and fills in only the consumer of each entry. Every other way of getting a bulk array has the supply name set, because the caller provides it, and the core expects it to be there: regulator_bulk_enable() prints it when a supply fails to enable, so a caller that hands such an array to it dereferences uninitialised memory on that path. Copy each name into the array's own allocation, right behind the entries, so that it shares the array's lifetime and callers still have nothing extra to free. That also retires the fixed 64 byte stack buffer the names were assembled in, which is_supply_name() never bounded the copy against.
    Severity
    No CVSS data available.
    Assigner
    Linux CNA
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 27b9ecc7a9ba1d0014779bfe5a6dbf630899c6e7 , < a5f43540e14589b53f80306d25c043c0abdcbca0 (git)
    Affected: 27b9ecc7a9ba1d0014779bfe5a6dbf630899c6e7 , < 82ac8c4939bdbd064b4f54a580fbe4baf0d60e41 (git)
    Affected: 27b9ecc7a9ba1d0014779bfe5a6dbf630899c6e7 , < a3384ec2516a7cc567bd7c09029282494469b247 (git)
    Affected: 27b9ecc7a9ba1d0014779bfe5a6dbf630899c6e7 , < e2151c29cec73f6cc70abf1c7cbc7b9b202489f5 (git)
    Affected: fd5015686d898db6642e05cfa1cc4e1289631ecb (git)
    Affected: 6.1.110 , < 6.2 (semver)
    		Create a notification for this product.
    Linux Linux Affected: 6.2
    Unaffected: 0 , < 6.2 (semver)
    Unaffected: 6.12.117 , ≤ 6.12.* (semver)
    Unaffected: 6.18.57 , ≤ 6.18.* (semver)
    Unaffected: 7.2.11 , ≤ 7.2.* (semver)
    Unaffected: 7.3 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/regulator/of_regulator.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a5f43540e14589b53f80306d25c043c0abdcbca0",
              "status": "affected",
              "version": "27b9ecc7a9ba1d0014779bfe5a6dbf630899c6e7",
              "versionType": "git"
            },
            {
              "lessThan": "82ac8c4939bdbd064b4f54a580fbe4baf0d60e41",
              "status": "affected",
              "version": "27b9ecc7a9ba1d0014779bfe5a6dbf630899c6e7",
              "versionType": "git"
            },
            {
              "lessThan": "a3384ec2516a7cc567bd7c09029282494469b247",
              "status": "affected",
              "version": "27b9ecc7a9ba1d0014779bfe5a6dbf630899c6e7",
              "versionType": "git"
            },
            {
              "lessThan": "e2151c29cec73f6cc70abf1c7cbc7b9b202489f5",
              "status": "affected",
              "version": "27b9ecc7a9ba1d0014779bfe5a6dbf630899c6e7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "fd5015686d898db6642e05cfa1cc4e1289631ecb",
              "versionType": "git"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.110",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/regulator/of_regulator.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.117",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.11",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.110",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: of: fill in supply names in of_regulator_bulk_get_all()\n\nof_regulator_bulk_get_all() returns an array it allocated itself, and\nfills in only the consumer of each entry. Every other way of getting a\nbulk array has the supply name set, because the caller provides it, and\nthe core expects it to be there: regulator_bulk_enable() prints it when\na supply fails to enable, so a caller that hands such an array to it\ndereferences uninitialised memory on that path.\n\nCopy each name into the array\u0027s own allocation, right behind the\nentries, so that it shares the array\u0027s lifetime and callers still have\nnothing extra to free. That also retires the fixed 64 byte stack buffer\nthe names were assembled in, which is_supply_name() never bounded the\ncopy against."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:15:22.599Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a5f43540e14589b53f80306d25c043c0abdcbca0"
        },
        {
          "url": "https://git.kernel.org/stable/c/82ac8c4939bdbd064b4f54a580fbe4baf0d60e41"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3384ec2516a7cc567bd7c09029282494469b247"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2151c29cec73f6cc70abf1c7cbc7b9b202489f5"
        }
      ],
      "title": "regulator: of: fill in supply names in of_regulator_bulk_get_all()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99021",
    "datePublished": "2026-10-23T12:21:00.951Z",
    "dateReserved": "2026-09-25T10:25:14.386Z",
    "dateUpdated": "2026-11-10T18:15:22.599Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-98996 (GCVE-0-2026-98996)

    Vulnerability from cvelistv5 – Published: 2026-10-23 12:20 – Updated: 2026-11-10 18:15
    VLAI
    Title
    fs: don't silently unmount busy mounts
    Summary
    In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagate_mount_busy() helper exists to decide whether a synchronous can suceed. It does that by looking at the copies of the victims in the mounts its parent propagates to. One of those functions from propagation hell. It skips a copy that has child mounts except for the case of a single child mount covering the copy's root. That algorithm used to be exact. It isn't anymore. Originally only childless copies were unmounted during propagation. And 1064f874abc0 ("mnt: Tuck mounts under others instead of creating shadow/side mounts.") ended up adding covered mounts to both sides in one go. Along came 99b19d16471e ("mnt: In propgate_umount handle visiting mounts in any order") and that started to unmount more than before: [1]: A copy of a mount is unmounted when each of its children is either its overmount or a copy of the victim itself. In the former case the overmount gets reparented. In the latter case the copy of the victim will end up being unmounted. So propagate_umount() ended up being rewritten without adjusting propagate_mount_busy(). And currently propagate_mount_busy() doesn't look at copies of the victim that have two or more children nor a single child that is not the overmount. So any such copy in [1] is not checked for references. The result is that a synchronous unmount succeeds, pulling out a mount that is still in use. A container can run into this with its own mounts. The host shares a tree with the container and the host has a mount in that tree: mount -t tmpfs none /mnt mount --make-shared /mnt mount -t tmpfs none /mnt/a The container's /mnt is a slave copy of the host mount. The container now takes a detached copy of the tree and mounts that copy beneath its propagated copy of /mnt/a and keeps the file descriptor to the tree open: unshare -m --propagation unchanged mount --make-rslave / fd = open_tree(AT_FDCWD, "/mnt", OPEN_TREE_CLONE | AT_RECURSIVE) move_mount(fd, "", AT_FDCWD, "/mnt/a", MOVE_MOUNT_BENEATH) grep /mnt /proc/self/mountinfo 775 355 ... /mnt ... master:646 777 775 ... /mnt/a ... master:646 776 777 ... /mnt/a ... master:647 778 777 ... /mnt/a/a ... master:647 The now attached tree (777) is now mounted beneath the container's copy of /mnt/a. That's also where the host mount sits (as seen from the host mount namespace). So the propagated copy (776) of the host's mount is on top of its root and the copy of that (778) is inside it. Now the host runs: umount /mnt/a and it succeeds. The moved tree tree and the copy inside of it are gone from the container. Now only the propagated copy is left and it got reparented to where it was before: grep /mnt /proc/self/mountinfo 775 355 ... /mnt ... master:646 776 775 ... /mnt/a ... But the file descriptor still refers to the moved tree. So a synchronous umount detached a mount that is still in use. Teach propagate_mount_busy() the same checks that propagate_umount() does. It now checks for a single victim mount without children for which it can assume that MNT_LOCKED is cleared on every copy like propagate_umount() does. The copies form chains. IOW, when a copy itself receives propagation from the victim's parent then the mount at the same mountpoint inside that copy is a copy as well. Whether a mount receives propagation from the victim's can simply be checked by walking its masters. Walk each chain once from its top so we are sure that nested copies stay linear. Check every reference once of every copy that gets unmounted.
    Severity
    No CVSS data available.
    Assigner
    Linux CNA
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 99b19d16471e9c3faa85cad38abc9cbbe04c6d55 , < 97c9ca40b67eafbe61a253e28cd51dddb7c6bec4 (git)
    Affected: 99b19d16471e9c3faa85cad38abc9cbbe04c6d55 , < bf2c8dec26fb792876b5e9bde7030c45d8be3908 (git)
    Affected: 99b19d16471e9c3faa85cad38abc9cbbe04c6d55 , < a210ac218c307513d43e98a08f23c2dfbeeebc2f (git)
    Affected: 99b19d16471e9c3faa85cad38abc9cbbe04c6d55 , < 6857e209015f95be7a8f19a9cd5dac345b9b9859 (git)
    Affected: dc5ce95b0252d143497283f7f659840d4f8a79d0 (git)
    Affected: fdb8f10499924d96b8eb60cc1354b278f6fcf0e9 (git)
    Affected: bb4fbf094b440a9209ed88c8681960d4b26eec0f (git)
    Affected: b43f81ef0babcc07db1eaaece37c989204e4ff00 (git)
    Affected: 81311d1698c0c87c972ba71d3ce44a617b52ea21 (git)
    Affected: 4.1.43 , < 4.2 (semver)
    Affected: 4.4.78 , < 4.5 (semver)
    Affected: 4.9.39 , < 4.10 (semver)
    Affected: 4.11.12 , < 4.12 (semver)
    Affected: 4.12.3 , < 4.13 (semver)
    		Create a notification for this product.
    Linux Linux Affected: 4.13
    Unaffected: 0 , < 4.13 (semver)
    Unaffected: 6.12.117 , ≤ 6.12.* (semver)
    Unaffected: 6.18.57 , ≤ 6.18.* (semver)
    Unaffected: 7.2.11 , ≤ 7.2.* (semver)
    Unaffected: 7.3 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/pnode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "97c9ca40b67eafbe61a253e28cd51dddb7c6bec4",
              "status": "affected",
              "version": "99b19d16471e9c3faa85cad38abc9cbbe04c6d55",
              "versionType": "git"
            },
            {
              "lessThan": "bf2c8dec26fb792876b5e9bde7030c45d8be3908",
              "status": "affected",
              "version": "99b19d16471e9c3faa85cad38abc9cbbe04c6d55",
              "versionType": "git"
            },
            {
              "lessThan": "a210ac218c307513d43e98a08f23c2dfbeeebc2f",
              "status": "affected",
              "version": "99b19d16471e9c3faa85cad38abc9cbbe04c6d55",
              "versionType": "git"
            },
            {
              "lessThan": "6857e209015f95be7a8f19a9cd5dac345b9b9859",
              "status": "affected",
              "version": "99b19d16471e9c3faa85cad38abc9cbbe04c6d55",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dc5ce95b0252d143497283f7f659840d4f8a79d0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "fdb8f10499924d96b8eb60cc1354b278f6fcf0e9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "bb4fbf094b440a9209ed88c8681960d4b26eec0f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b43f81ef0babcc07db1eaaece37c989204e4ff00",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "81311d1698c0c87c972ba71d3ce44a617b52ea21",
              "versionType": "git"
            },
            {
              "lessThan": "4.2",
              "status": "affected",
              "version": "4.1.43",
              "versionType": "semver"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.78",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.39",
              "versionType": "semver"
            },
            {
              "lessThan": "4.12",
              "status": "affected",
              "version": "4.11.12",
              "versionType": "semver"
            },
            {
              "lessThan": "4.13",
              "status": "affected",
              "version": "4.12.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/pnode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.117",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.11",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.1.43",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.78",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.11.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.12.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs: don\u0027t silently unmount busy mounts\n\nThe propagate_mount_busy() helper exists to decide whether a synchronous\ncan suceed. It does that by looking at the copies of the victims in the\nmounts its parent propagates to. One of those functions from propagation\nhell.\n\nIt skips a copy that has child mounts except for the case of a single\nchild mount covering the copy\u0027s root. That algorithm used to be exact.\nIt isn\u0027t anymore.\n\nOriginally only childless copies were unmounted during propagation.\nAnd 1064f874abc0 (\"mnt: Tuck mounts under others instead of creating\nshadow/side mounts.\") ended up adding covered mounts to both sides in\none go.\n\nAlong came 99b19d16471e (\"mnt: In propgate_umount handle visiting mounts\nin any order\") and that started to unmount more than before:\n\n[1]: A copy of a mount is unmounted when each of its children is either\n     its overmount or a copy of the victim itself. In the former case\n     the overmount gets reparented. In the latter case the copy of the\n     victim will end up being unmounted.\n\nSo propagate_umount() ended up being rewritten without adjusting\npropagate_mount_busy(). And currently propagate_mount_busy() doesn\u0027t\nlook at copies of the victim that have two or more children nor a single\nchild that is not the overmount.\n\nSo any such copy in [1] is not checked for\nreferences. The result is that a synchronous unmount succeeds, pulling\nout a mount that is still in use.\n\nA container can run into this with its own mounts. The host shares a\ntree with the container and the host has a mount in that tree:\n\n  mount -t tmpfs none /mnt\n  mount --make-shared /mnt\n  mount -t tmpfs none /mnt/a\n\nThe container\u0027s /mnt is a slave copy of the host mount. The container\nnow takes a detached copy of the tree and mounts that copy beneath its\npropagated copy of /mnt/a and keeps the file descriptor to the tree\nopen:\n\n  unshare -m --propagation unchanged\n  mount --make-rslave /\n  fd = open_tree(AT_FDCWD, \"/mnt\", OPEN_TREE_CLONE | AT_RECURSIVE)\n  move_mount(fd, \"\", AT_FDCWD, \"/mnt/a\", MOVE_MOUNT_BENEATH)\n\n  grep /mnt /proc/self/mountinfo\n  775 355 ... /mnt ...     master:646\n  777 775 ... /mnt/a ...   master:646\n  776 777 ... /mnt/a ...   master:647\n  778 777 ... /mnt/a/a ... master:647\n\nThe now attached tree (777) is now mounted beneath the container\u0027s copy\nof /mnt/a. That\u0027s also where the host mount sits (as seen from the host\nmount namespace). So the propagated copy (776) of the host\u0027s mount is on\ntop of its root and the copy of that (778) is inside it. Now the host\nruns:\n\n  umount /mnt/a\n\nand it succeeds. The moved tree tree and the copy inside of it are gone\nfrom the container. Now only the propagated copy is left and it got\nreparented to where it was before:\n\n  grep /mnt /proc/self/mountinfo\n  775 355 ... /mnt ... master:646\n  776 775 ... /mnt/a ...\n\nBut the file descriptor still refers to the moved tree. So a synchronous\numount detached a mount that is still in use.\n\nTeach propagate_mount_busy() the same checks that propagate_umount()\ndoes. It now checks for a single victim mount without children\nfor which it can assume that MNT_LOCKED is cleared on every copy like\npropagate_umount() does. The copies form chains. IOW, when a copy itself\nreceives propagation from the victim\u0027s parent then the mount at the same\nmountpoint inside that copy is a copy as well. Whether a mount receives\npropagation from the victim\u0027s can simply be checked by walking its\nmasters. Walk each chain once from its top so we are sure that nested\ncopies stay linear. Check every reference once of every copy that gets\nunmounted."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:15:22.209Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/97c9ca40b67eafbe61a253e28cd51dddb7c6bec4"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf2c8dec26fb792876b5e9bde7030c45d8be3908"
        },
        {
          "url": "https://git.kernel.org/stable/c/a210ac218c307513d43e98a08f23c2dfbeeebc2f"
        },
        {
          "url": "https://git.kernel.org/stable/c/6857e209015f95be7a8f19a9cd5dac345b9b9859"
        }
      ],
      "title": "fs: don\u0027t silently unmount busy mounts",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98996",
    "datePublished": "2026-10-23T12:20:15.188Z",
    "dateReserved": "2026-09-25T10:25:14.384Z",
    "dateUpdated": "2026-11-10T18:15:22.209Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-98989 (GCVE-0-2026-98989)

    Vulnerability from cvelistv5 – Published: 2026-10-23 12:20 – Updated: 2026-11-10 18:15
    VLAI
    Title
    namespace: check a recursive bind mount for mount namespace loops
    Summary
    In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops do_loopback() refuses to bind mount the file of a mount namespace that is as old as the caller's or older because a mount namespace that holds a mount of its own file, or of an ancestor's, would cause a cycle. But it only checks the dentry the bind mount starts from. With MS_REC everything below it is copied and do_loopback() passes CL_COPY_MNT_NS_FILE so mount namespace files below the source are copied. That's fine for a source in the caller's own mount namespace. Every mount namespace file in there passed the same check when it was bind-mounted. It isn't fine for a source in another mount namespace. may_copy_tree() accepts a bind mount of any nsfs or pidfs file no matter what mount namespace it lives in so that /proc/<pid>/ns/<ns> and pidfds can be bind mounted. If we create a bind-mount stack of mount namespaces file descriptors the kernel will copy them irrespective of their ancestoral relationship to the mount namespace in question: 151 146 0:7 net:[4026531833] /tmp/nrc/y rw - nsfs nsfs rw 152 151 0:7 mnt:[4026532293] /tmp/nrc/y rw - nsfs nsfs rw Mount 152 is a mount of the mount namespace file of mount namespace 4026532293 inside mount namespace 4026532293. That namespace and every mount in it are leaked... All it takes is a process in an older mount namespace that stacks the file and repeating it leaks without limit: after control: Shmem: 380 kB child: mount(/proc/self/fd/6, MS_BIND|MS_REC): ok after cycle: Shmem: 65916 kB do_move_mount() runs check_for_nsfs_mounts() over a detached tree for exactly that reason. Do the same for the copy before it is grafted.
    Severity
    No CVSS data available.
    Assigner
    Linux CNA
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: e149ed2b805fefdccf7ccdfc19eca22fdd4514ac , < b82f3c1131456537a514595c3991b62652507c9d (git)
    Affected: e149ed2b805fefdccf7ccdfc19eca22fdd4514ac , < a0ba48256f5dff6f75a45f8ce39fe57f21df1022 (git)
    Affected: e149ed2b805fefdccf7ccdfc19eca22fdd4514ac , < 37a82f400efa4d263542a5fa41755b21057f1e5d (git)
    Affected: e149ed2b805fefdccf7ccdfc19eca22fdd4514ac , < c640a01a78e42302879006ed7b7d5a9a943ba815 (git)
    		Create a notification for this product.
    Linux Linux Affected: 3.19
    Unaffected: 0 , < 3.19 (semver)
    Unaffected: 6.12.117 , ≤ 6.12.* (semver)
    Unaffected: 6.18.57 , ≤ 6.18.* (semver)
    Unaffected: 7.2.11 , ≤ 7.2.* (semver)
    Unaffected: 7.3 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/namespace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b82f3c1131456537a514595c3991b62652507c9d",
              "status": "affected",
              "version": "e149ed2b805fefdccf7ccdfc19eca22fdd4514ac",
              "versionType": "git"
            },
            {
              "lessThan": "a0ba48256f5dff6f75a45f8ce39fe57f21df1022",
              "status": "affected",
              "version": "e149ed2b805fefdccf7ccdfc19eca22fdd4514ac",
              "versionType": "git"
            },
            {
              "lessThan": "37a82f400efa4d263542a5fa41755b21057f1e5d",
              "status": "affected",
              "version": "e149ed2b805fefdccf7ccdfc19eca22fdd4514ac",
              "versionType": "git"
            },
            {
              "lessThan": "c640a01a78e42302879006ed7b7d5a9a943ba815",
              "status": "affected",
              "version": "e149ed2b805fefdccf7ccdfc19eca22fdd4514ac",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/namespace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.19"
            },
            {
              "lessThan": "3.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.117",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.11",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: check a recursive bind mount for mount namespace loops\n\ndo_loopback() refuses to bind mount the file of a mount namespace that\nis as old as the caller\u0027s or older because a mount namespace that holds\na mount of its own file, or of an ancestor\u0027s, would cause a cycle. But\nit only checks the dentry the bind mount starts from. With MS_REC\neverything below it is copied and do_loopback() passes\nCL_COPY_MNT_NS_FILE so mount namespace files below the source are\ncopied.\n\nThat\u0027s fine for a source in the caller\u0027s own mount namespace. Every\nmount namespace file in there passed the same check when it was\nbind-mounted. It isn\u0027t fine for a source in another mount namespace.\nmay_copy_tree() accepts a bind mount of any nsfs or pidfs file no matter\nwhat mount namespace it lives in so that /proc/\u003cpid\u003e/ns/\u003cns\u003e and pidfds\ncan be bind mounted. If we create a bind-mount stack of mount namespaces\nfile descriptors the kernel will copy them irrespective of their\nancestoral relationship to the mount namespace in question:\n\n  151 146 0:7 net:[4026531833] /tmp/nrc/y rw - nsfs nsfs rw\n  152 151 0:7 mnt:[4026532293] /tmp/nrc/y rw - nsfs nsfs rw\n\nMount 152 is a mount of the mount namespace file of mount namespace\n4026532293 inside mount namespace 4026532293. That namespace and every\nmount in it are leaked... All it takes is a process in an older mount\nnamespace that stacks the file and repeating it leaks without limit:\n\n  after control: Shmem:               380 kB\n  child: mount(/proc/self/fd/6, MS_BIND|MS_REC): ok\n  after cycle: Shmem:             65916 kB\n\ndo_move_mount() runs check_for_nsfs_mounts() over a detached tree for\nexactly that reason. Do the same for the copy before it is grafted."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:15:21.865Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b82f3c1131456537a514595c3991b62652507c9d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a0ba48256f5dff6f75a45f8ce39fe57f21df1022"
        },
        {
          "url": "https://git.kernel.org/stable/c/37a82f400efa4d263542a5fa41755b21057f1e5d"
        },
        {
          "url": "https://git.kernel.org/stable/c/c640a01a78e42302879006ed7b7d5a9a943ba815"
        }
      ],
      "title": "namespace: check a recursive bind mount for mount namespace loops",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98989",
    "datePublished": "2026-10-23T12:20:08.366Z",
    "dateReserved": "2026-09-25T10:25:14.384Z",
    "dateUpdated": "2026-11-10T18:15:21.865Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-98978 (GCVE-0-2026-98978)

    Vulnerability from cvelistv5 – Published: 2026-10-23 12:19 – Updated: 2026-11-10 18:15
    VLAI
    Title
    namespace: never expire a locked mount
    Summary
    In the Linux kernel, the following vulnerability has been resolved: namespace: never expire a locked mount Locked mounts are special. They protect the underlying files and directories from being revealed. do_umount() refuses to unmount locked mounts but shrink_submounts() doesn't. A shrinkable mount can become locked once the owner of a user namespace puts it beneath a locked mount with MOVE_MOUNT_BENEATH. The locked property now moves to the mount at the bottom making it possible to unmount the top mount. So umount() of an unlocked ancestor now expires the bottom mount first and the covered directory is revealed: move_mount(c -> x/hidden, MOVE_MOUNT_BENEATH) = 0 the cover after the lock moved: umount2(x/hidden) = 0 the holder of the lock: umount2(x/hidden) = EINVAL the root of the copy, busy: umount2(x) = EBUSY reads x/hidden/secret: "covered-by-root" So leave a locked mount alone as it dies together with its parent. A plain umount() of an unlocked mount with a locked one below it is EBUSY from now on. It's the same for any other locked child. A lazy umount still takes the whole tree. mark_mounts_for_expiry() never sees a locked mount. lock_mnt_tree() leaves a mount on an expiry list alone and nothing else puts a locked one on such a list. Add an assert for this.
    Severity
    8.4 (High)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
    Assigner
    Linux CNA
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 5ff9d8a65ce80efb509ce4e8051394e9ed2cd942 , < 6c8013ea84fcc51cf26aa870b61b5388c7196ed5 (git)
    Affected: 5ff9d8a65ce80efb509ce4e8051394e9ed2cd942 , < 6b8dc3713a76346d212abab46cbfc8d7070f534c (git)
    Affected: 5ff9d8a65ce80efb509ce4e8051394e9ed2cd942 , < d23265a12e4991ce7aedce670c0b6b598cadb644 (git)
    Affected: 5ff9d8a65ce80efb509ce4e8051394e9ed2cd942 , < f78ddcc872248c7aa1d7e904928441a0be4c6d5d (git)
    		Create a notification for this product.
    Linux Linux Affected: 3.12
    Unaffected: 0 , < 3.12 (semver)
    Unaffected: 6.12.117 , ≤ 6.12.* (semver)
    Unaffected: 6.18.57 , ≤ 6.18.* (semver)
    Unaffected: 7.2.11 , ≤ 7.2.* (semver)
    Unaffected: 7.3 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/namespace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6c8013ea84fcc51cf26aa870b61b5388c7196ed5",
              "status": "affected",
              "version": "5ff9d8a65ce80efb509ce4e8051394e9ed2cd942",
              "versionType": "git"
            },
            {
              "lessThan": "6b8dc3713a76346d212abab46cbfc8d7070f534c",
              "status": "affected",
              "version": "5ff9d8a65ce80efb509ce4e8051394e9ed2cd942",
              "versionType": "git"
            },
            {
              "lessThan": "d23265a12e4991ce7aedce670c0b6b598cadb644",
              "status": "affected",
              "version": "5ff9d8a65ce80efb509ce4e8051394e9ed2cd942",
              "versionType": "git"
            },
            {
              "lessThan": "f78ddcc872248c7aa1d7e904928441a0be4c6d5d",
              "status": "affected",
              "version": "5ff9d8a65ce80efb509ce4e8051394e9ed2cd942",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/namespace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.117",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.11",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnamespace: never expire a locked mount\n\nLocked mounts are special. They protect the underlying files and\ndirectories from being revealed. do_umount() refuses to unmount locked\nmounts but shrink_submounts() doesn\u0027t.\n\nA shrinkable mount can become locked once the owner of a user namespace\nputs it beneath a locked mount with MOVE_MOUNT_BENEATH. The locked\nproperty now moves to the mount at the bottom making it possible to\nunmount the top mount.\n\nSo umount() of an unlocked ancestor now expires the bottom mount first\nand the covered directory is revealed:\n\n  move_mount(c -\u003e x/hidden, MOVE_MOUNT_BENEATH) = 0\n  the cover after the lock moved:  umount2(x/hidden) = 0\n  the holder of the lock:          umount2(x/hidden) = EINVAL\n  the root of the copy, busy:      umount2(x) = EBUSY\n  reads x/hidden/secret: \"covered-by-root\"\n\nSo leave a locked mount alone as it dies together with its parent. A\nplain umount() of an unlocked mount with a locked one below it is EBUSY\nfrom now on. It\u0027s the same for any other locked child. A lazy umount\nstill takes the whole tree.\n\nmark_mounts_for_expiry() never sees a locked mount. lock_mnt_tree()\nleaves a mount on an expiry list alone and nothing else puts a locked\none on such a list. Add an assert for this."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - umount2() reaches ksys_umount() -\u003e path_umount() -\u003e do_umount() -\u003e shrink_submounts() -\u003e the patched shrink_submount(); all triggering state is supplied through local mount syscalls, not a network protocol.\nAC:L - fuse_dentry_automount() can create an attacker-controlled mount that finish_automount() marks MNT_SHRINKABLE, and clone_mnt() preserves that flag. The lock transfer with MOVE_MOUNT_BENEATH and ancestor umount2() are deterministic and require no race.\nPR:L - move_mount() and can_umount() require may_mount(), which checks CAP_SYS_ADMIN in the mount namespace\u0027s owning user namespace. An ordinary user obtains that capability through unshare(CLONE_NEWUSER|CLONE_NEWNS), as exercised by expiry_child().\nUI:N - The attacker independently performs unshare(), bind mounts, move_mount(MOVE_MOUNT_BENEATH), umount2(), and the final file access; no victim action is needed after the sandbox mount layout exists.\nS:C - MNT_LOCKED is applied by lock_mnt_tree() specifically to stop a less-privileged child user/mount namespace from exposing resources hidden by its parent; removing that cover crosses this sandbox boundary.\nC:H - Vulnerable shrink_submount() calls umount_tree() on the locked mount, causing path lookup to fall through to the entire concealed directory subtree rather than a bounded datum; in a same-identity sandbox this can disclose all files protected solely by the mount cover.\nI:H - The same umount_tree() operation exposes every object below the covered directory; where the mount namespace was the access-control boundary for a same-identity sandbox, the attacker can modify or delete the entire otherwise-hidden writable subtree.\nA:N - The flaw neither corrupts memory nor crashes or hangs the kernel; umount_tree() detaches a mount from the attacker\u0027s copied mount namespace, and the demonstrated consequence is exposure of the covered path."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:15:21.525Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6c8013ea84fcc51cf26aa870b61b5388c7196ed5"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b8dc3713a76346d212abab46cbfc8d7070f534c"
        },
        {
          "url": "https://git.kernel.org/stable/c/d23265a12e4991ce7aedce670c0b6b598cadb644"
        },
        {
          "url": "https://git.kernel.org/stable/c/f78ddcc872248c7aa1d7e904928441a0be4c6d5d"
        }
      ],
      "title": "namespace: never expire a locked mount",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98978",
    "datePublished": "2026-10-23T12:19:51.428Z",
    "dateReserved": "2026-09-25T10:25:14.383Z",
    "dateUpdated": "2026-11-10T18:15:21.525Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-98920 (GCVE-0-2026-98920)

    Vulnerability from cvelistv5 – Published: 2026-10-23 12:02 – Updated: 2026-11-10 18:15
    VLAI
    Title
    netfs: Fix missing alloc tagging of direct mempool allocations
    Summary
    In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing alloc tagging of direct mempool allocations Commit 1d78d56c43ef ("netfs: Fix folio_queue ENOMEM in writeback by adding a mempool") added a mempool for the folio_queues and made the request, subrequest and folio_queue allocations distinguish between writeback and everything else. Writeback is part of memory reclaim and must not fail due to ENOMEM, so it allocates under GFP_NOFS through mempool_alloc(), which may dip into the pool's reserve and, if that runs empty, wait for elements to be returned. The GFP_KERNEL paths, which can return -ENOMEM to their callers, invoke the pool's ->alloc() callback directly instead. The direct call, however, skips the alloc_hooks() wrapper that the mempool_alloc() macro provides. The pool callbacks, mempool_alloc_slab() and mempool_kmalloc(), call kmem_cache_alloc_noprof() and kmalloc_noprof() and rely on current->alloc_tag having been set by the caller. With CONFIG_MEM_ALLOC_PROFILING_DEBUG=y this leads to current->alloc_tag not set WARNING: ./include/linux/alloc_tag.h:161 at __alloc_tagging_slab_alloc_hook alloc_tag was not set WARNING: ./include/linux/alloc_tag.h:166 at __alloc_tagging_slab_free_hook at allocation and free time respectively, as reported when reading files on a CIFS mount. The allocations are also missing from /proc/allocinfo. Wrap the direct ->alloc() invocations in alloc_hooks() with a new mempool_alloc_noreserve() helper in include/linux/mempool.h, next to the other alloc_hooks()-wrapped macros such as mempool_alloc(). The GFP_KERNEL paths keep their failable allocation semantics, they just get tagged now.
    Severity
    No CVSS data available.
    Assigner
    Linux CNA
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: b343252d6f536203dd0660f676190dcbf6d2ecdc , < 6ba3d758cd40888908f96d68d69322dad65a871e (git)
    Affected: 15ed8a9b7c63e9171f5139a6aaa1ffb61809861f , < 5c03da745171485fd181f17b69213464f6d05f3d (git)
    Affected: 1d78d56c43ef3768183e8370e7367b162700e049 , < 37a2042748bc880df03ff8315db86ed82991fbb8 (git)
    Affected: 1d78d56c43ef3768183e8370e7367b162700e049 , < b78b728e21c32ec4c330b299f657fb1eb02dffc2 (git)
    Affected: 3f6d7f8a5416d852648d15a05e895f1195ee8a85 (git)
    Affected: 6.12.114 , < 6.12.117 (semver)
    Affected: 7.1.8 , < 7.2 (semver)
    		Create a notification for this product.
    Linux Linux Affected: 7.2
    Unaffected: 0 , < 7.2 (semver)
    Unaffected: 6.12.117 , ≤ 6.12.* (semver)
    Unaffected: 7.2.9 , ≤ 7.2.* (semver)
    Unaffected: 7.3 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/netfs/objects.c",
            "fs/netfs/rolling_buffer.c",
            "include/linux/mempool.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6ba3d758cd40888908f96d68d69322dad65a871e",
              "status": "affected",
              "version": "b343252d6f536203dd0660f676190dcbf6d2ecdc",
              "versionType": "git"
            },
            {
              "lessThan": "5c03da745171485fd181f17b69213464f6d05f3d",
              "status": "affected",
              "version": "15ed8a9b7c63e9171f5139a6aaa1ffb61809861f",
              "versionType": "git"
            },
            {
              "lessThan": "37a2042748bc880df03ff8315db86ed82991fbb8",
              "status": "affected",
              "version": "1d78d56c43ef3768183e8370e7367b162700e049",
              "versionType": "git"
            },
            {
              "lessThan": "b78b728e21c32ec4c330b299f657fb1eb02dffc2",
              "status": "affected",
              "version": "1d78d56c43ef3768183e8370e7367b162700e049",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3f6d7f8a5416d852648d15a05e895f1195ee8a85",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.117",
              "status": "affected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThan": "7.2",
              "status": "affected",
              "version": "7.1.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/netfs/objects.c",
            "fs/netfs/rolling_buffer.c",
            "include/linux/mempool.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.2"
            },
            {
              "lessThan": "7.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.117",
                  "versionStartIncluding": "6.12.114",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.9",
                  "versionStartIncluding": "7.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "7.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "7.1.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix missing alloc tagging of direct mempool allocations\n\nCommit 1d78d56c43ef (\"netfs: Fix folio_queue ENOMEM in writeback by\nadding a mempool\") added a mempool for the folio_queues and made the\nrequest, subrequest and folio_queue allocations distinguish between\nwriteback and everything else.  Writeback is part of memory reclaim\nand must not fail due to ENOMEM, so it allocates under GFP_NOFS\nthrough mempool_alloc(), which may dip into the pool\u0027s reserve and,\nif that runs empty, wait for elements to be returned.  The\nGFP_KERNEL paths, which can return -ENOMEM to their callers, invoke\nthe pool\u0027s -\u003ealloc() callback directly instead.\n\nThe direct call, however, skips the alloc_hooks() wrapper that the\nmempool_alloc() macro provides.  The pool callbacks, mempool_alloc_slab()\nand mempool_kmalloc(), call kmem_cache_alloc_noprof() and kmalloc_noprof()\nand rely on current-\u003ealloc_tag having been set by the caller.  With\nCONFIG_MEM_ALLOC_PROFILING_DEBUG=y this leads to\n\n    current-\u003ealloc_tag not set\n    WARNING: ./include/linux/alloc_tag.h:161 at __alloc_tagging_slab_alloc_hook\n    alloc_tag was not set\n    WARNING: ./include/linux/alloc_tag.h:166 at __alloc_tagging_slab_free_hook\n\nat allocation and free time respectively, as reported when reading\nfiles on a CIFS mount.  The allocations are also missing from\n/proc/allocinfo.\n\nWrap the direct -\u003ealloc() invocations in alloc_hooks() with a new\nmempool_alloc_noreserve() helper in include/linux/mempool.h, next to\nthe other alloc_hooks()-wrapped macros such as mempool_alloc().  The\nGFP_KERNEL paths keep their failable allocation semantics, they just\nget tagged now."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:15:20.857Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6ba3d758cd40888908f96d68d69322dad65a871e"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c03da745171485fd181f17b69213464f6d05f3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/37a2042748bc880df03ff8315db86ed82991fbb8"
        },
        {
          "url": "https://git.kernel.org/stable/c/b78b728e21c32ec4c330b299f657fb1eb02dffc2"
        }
      ],
      "title": "netfs: Fix missing alloc tagging of direct mempool allocations",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98920",
    "datePublished": "2026-10-23T12:02:06.560Z",
    "dateReserved": "2026-09-25T10:25:14.380Z",
    "dateUpdated": "2026-11-10T18:15:20.857Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-98863 (GCVE-0-2026-98863)

    Vulnerability from cvelistv5 – Published: 2026-10-18 15:51 – Updated: 2026-11-10 18:15
    VLAI
    Title
    KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails
    Summary
    In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails Re-pend GET_NESTED_STATE_PAGES before exiting to userspace if getting the nested pages fails in the KVM_RUN path. If userspace re-runs the vCPU, and vmcs02 holds valid PFNs from the *previous* run of L2, then KVM could re-enter L2 with stale, unpinned PFNs mapped into e.g. the vAPIC page. Note, both SVM and VMX (as of commit 11722439fb20 ("KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit") ensure the request is cleared on VM-Exit (including the "forced" case), i.e. there is no risk of double-mapping due to emulated VMLAUNCH/VMRESUME/VMRUN *and* the request trying to map the nested pages.
    Severity
    No CVSS data available.
    Assigner
    Linux CNA
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 671ddc700fd08b94967b1e2a937020e30c838609 , < 1e231eedb0c5aafdc8d96a816ec75554aa69004d (git)
    Affected: 671ddc700fd08b94967b1e2a937020e30c838609 , < 525694a6021ec6c8f7ce1f38acdf2dd77698fec1 (git)
    Affected: 671ddc700fd08b94967b1e2a937020e30c838609 , < 942192dbcd3a06695ef6b31cf10a41a21cf014d8 (git)
    Affected: 671ddc700fd08b94967b1e2a937020e30c838609 , < 10180a277549339020b08000206092c07e0bff5a (git)
    		Create a notification for this product.
    Linux Linux Affected: 5.4
    Unaffected: 0 , < 5.4 (semver)
    Unaffected: 6.12.117 , ≤ 6.12.* (semver)
    Unaffected: 6.18.56 , ≤ 6.18.* (semver)
    Unaffected: 7.2.10 , ≤ 7.2.* (semver)
    Unaffected: 7.3 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/x86.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1e231eedb0c5aafdc8d96a816ec75554aa69004d",
              "status": "affected",
              "version": "671ddc700fd08b94967b1e2a937020e30c838609",
              "versionType": "git"
            },
            {
              "lessThan": "525694a6021ec6c8f7ce1f38acdf2dd77698fec1",
              "status": "affected",
              "version": "671ddc700fd08b94967b1e2a937020e30c838609",
              "versionType": "git"
            },
            {
              "lessThan": "942192dbcd3a06695ef6b31cf10a41a21cf014d8",
              "status": "affected",
              "version": "671ddc700fd08b94967b1e2a937020e30c838609",
              "versionType": "git"
            },
            {
              "lessThan": "10180a277549339020b08000206092c07e0bff5a",
              "status": "affected",
              "version": "671ddc700fd08b94967b1e2a937020e30c838609",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/x86.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.56",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.117",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.56",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.10",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails\n\nRe-pend GET_NESTED_STATE_PAGES before exiting to userspace if getting the\nnested pages fails in the KVM_RUN path.  If userspace re-runs the vCPU, and\nvmcs02 holds valid PFNs from the *previous* run of L2, then KVM could\nre-enter L2 with stale, unpinned PFNs mapped into e.g. the vAPIC page.\n\nNote, both SVM and VMX (as of commit 11722439fb20 (\"KVM: nVMX: Ensure\nKVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit\") ensure the request\nis cleared on VM-Exit (including the \"forced\" case), i.e. there is no risk\nof double-mapping due to emulated VMLAUNCH/VMRESUME/VMRUN *and* the request\ntrying to map the nested pages."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:15:20.513Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1e231eedb0c5aafdc8d96a816ec75554aa69004d"
        },
        {
          "url": "https://git.kernel.org/stable/c/525694a6021ec6c8f7ce1f38acdf2dd77698fec1"
        },
        {
          "url": "https://git.kernel.org/stable/c/942192dbcd3a06695ef6b31cf10a41a21cf014d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/10180a277549339020b08000206092c07e0bff5a"
        }
      ],
      "title": "KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98863",
    "datePublished": "2026-10-18T15:51:24.446Z",
    "dateReserved": "2026-09-25T10:25:14.376Z",
    "dateUpdated": "2026-11-10T18:15:20.513Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-98853 (GCVE-0-2026-98853)

    Vulnerability from cvelistv5 – Published: 2026-10-18 15:51 – Updated: 2026-11-10 18:15
    VLAI
    Title
    net: gso: limit recursive IP-in-IP segmentation
    Summary
    In the Linux kernel, the following vulnerability has been resolved: net: gso: limit recursive IP-in-IP segmentation IP-in-IP GSO can re-enter inet_gso_segment() or ipv6_gso_segment() for each nested IP header. encap_level tracks header bytes, not callback depth, so a deep chain can exhaust the kernel stack. Making inet_gso_segment() stackable introduced unbounded IPv4 nesting; IPIP GSO/TSO later made the path reachable. The IPv6 stackable path was introduced separately and uses the same guard. Count IPv4 and IPv6 GSO handler entries in skb_gso_cb, initialized once per top-level GSO operation and preserved across GRE/UDP context changes. Use the existing IP_TUNNEL_RECURSION_LIMIT for both handlers. The first five entries pass, and the sixth returns -EINVAL before dispatching another GSO callback.
    Severity
    No CVSS data available.
    Assigner
    Linux CNA
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: 3347c960295583eee3fd58e5c539fb1972fbc005 , < cadffc83ee1a560d5cd18e6d607c1d76f6fd4bd4 (git)
    Affected: 3347c960295583eee3fd58e5c539fb1972fbc005 , < 388604279da3d0698a151efa4fb6d852efa0de4a (git)
    Affected: 3347c960295583eee3fd58e5c539fb1972fbc005 , < c949646c900e879afce47df1b607fa320eb63bf2 (git)
    Affected: 3347c960295583eee3fd58e5c539fb1972fbc005 , < 006c8b834aed8b02bd8fb9fb05e9e7ead37d1763 (git)
    		Create a notification for this product.
    Linux Linux Affected: 3.13
    Unaffected: 0 , < 3.13 (semver)
    Unaffected: 6.12.117 , ≤ 6.12.* (semver)
    Unaffected: 6.18.60 , ≤ 6.18.* (semver)
    Unaffected: 7.2.10 , ≤ 7.2.* (semver)
    Unaffected: 7.3 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/gso.h",
            "net/core/gso.c",
            "net/ipv4/af_inet.c",
            "net/ipv6/ip6_offload.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cadffc83ee1a560d5cd18e6d607c1d76f6fd4bd4",
              "status": "affected",
              "version": "3347c960295583eee3fd58e5c539fb1972fbc005",
              "versionType": "git"
            },
            {
              "lessThan": "388604279da3d0698a151efa4fb6d852efa0de4a",
              "status": "affected",
              "version": "3347c960295583eee3fd58e5c539fb1972fbc005",
              "versionType": "git"
            },
            {
              "lessThan": "c949646c900e879afce47df1b607fa320eb63bf2",
              "status": "affected",
              "version": "3347c960295583eee3fd58e5c539fb1972fbc005",
              "versionType": "git"
            },
            {
              "lessThan": "006c8b834aed8b02bd8fb9fb05e9e7ead37d1763",
              "status": "affected",
              "version": "3347c960295583eee3fd58e5c539fb1972fbc005",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/gso.h",
            "net/core/gso.c",
            "net/ipv4/af_inet.c",
            "net/ipv6/ip6_offload.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "lessThan": "3.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.60",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.117",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.60",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.10",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gso: limit recursive IP-in-IP segmentation\n\nIP-in-IP GSO can re-enter inet_gso_segment() or ipv6_gso_segment()\nfor each nested IP header. encap_level tracks header bytes, not callback\ndepth, so a deep chain can exhaust the kernel stack. Making\ninet_gso_segment() stackable introduced unbounded IPv4 nesting; IPIP\nGSO/TSO later made the path reachable. The IPv6 stackable path was\nintroduced separately and uses the same guard.\n\nCount IPv4 and IPv6 GSO handler entries in skb_gso_cb, initialized once\nper top-level GSO operation and preserved across GRE/UDP context changes.\nUse the existing IP_TUNNEL_RECURSION_LIMIT for both handlers. The first\nfive entries pass, and the sixth returns -EINVAL before dispatching\nanother GSO callback."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:15:20.032Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cadffc83ee1a560d5cd18e6d607c1d76f6fd4bd4"
        },
        {
          "url": "https://git.kernel.org/stable/c/388604279da3d0698a151efa4fb6d852efa0de4a"
        },
        {
          "url": "https://git.kernel.org/stable/c/c949646c900e879afce47df1b607fa320eb63bf2"
        },
        {
          "url": "https://git.kernel.org/stable/c/006c8b834aed8b02bd8fb9fb05e9e7ead37d1763"
        }
      ],
      "title": "net: gso: limit recursive IP-in-IP segmentation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98853",
    "datePublished": "2026-10-18T15:51:02.683Z",
    "dateReserved": "2026-09-25T10:25:14.376Z",
    "dateUpdated": "2026-11-10T18:15:20.032Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-98786 (GCVE-0-2026-98786)

    Vulnerability from cvelistv5 – Published: 2026-10-18 15:48 – Updated: 2026-11-10 18:15
    VLAI
    Title
    drm/amd/display: guard dc_sink dereferences in MST mode validation
    Summary
    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: guard dc_sink dereferences in MST mode validation dm_dp_mst_is_port_support_mode() reads aconnector->dc_sink->dsc_caps... for the DSC branch-throughput check, and get_conv_frl_bw()'s HDMI-PCON FRL-bandwidth path reads aconnector->dc_sink->edid_caps.max_frl_rate, both without a NULL check. dc_sink is cleared asynchronously on MST unplug, and both functions run from paths that the driver's own comments document as racing that teardown: the connector probe worker's ->mode_valid callback and a compositor's atomic check, neither of which holds the MST manager lock that the teardown path uses. The former does have an existing dsc_aux NULL check, but dsc_aux isn't reliably cleared in every path that clears dc_sink, so it doesn't cover this. Fail the port-support check and skip the FRL conversion path when the sink is already gone. (cherry picked from commit 7c3db8da4e039698ae198c870712428644e965c7)
    Severity
    No CVSS data available.
    Assigner
    Linux CNA
    References
    Impacted products
    Vendor Product Version
    Linux Linux Affected: f04d275d94e164d24516c32437c988a323018f63 , < 0189f725242087679bc9f1bbf77ad086f56a72c8 (git)
    Affected: f04d275d94e164d24516c32437c988a323018f63 , < 5684a6c24c0d7c40ef2c4ccb3e4a64cffe76a791 (git)
    Affected: f04d275d94e164d24516c32437c988a323018f63 , < daa0437fe5e451856aaf8fda602a9fc2105bbd54 (git)
    Affected: f04d275d94e164d24516c32437c988a323018f63 , < 217f64f348c90cba62164e7ff38e0ccf78a5ca09 (git)
    		Create a notification for this product.
    Linux Linux Affected: 6.0
    Unaffected: 0 , < 6.0 (semver)
    Unaffected: 6.12.117 , ≤ 6.12.* (semver)
    Unaffected: 6.18.61 , ≤ 6.18.* (semver)
    Unaffected: 7.2.10 , ≤ 7.2.* (semver)
    Unaffected: 7.3 , ≤ * (original_commit_for_fix)
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0189f725242087679bc9f1bbf77ad086f56a72c8",
              "status": "affected",
              "version": "f04d275d94e164d24516c32437c988a323018f63",
              "versionType": "git"
            },
            {
              "lessThan": "5684a6c24c0d7c40ef2c4ccb3e4a64cffe76a791",
              "status": "affected",
              "version": "f04d275d94e164d24516c32437c988a323018f63",
              "versionType": "git"
            },
            {
              "lessThan": "daa0437fe5e451856aaf8fda602a9fc2105bbd54",
              "status": "affected",
              "version": "f04d275d94e164d24516c32437c988a323018f63",
              "versionType": "git"
            },
            {
              "lessThan": "217f64f348c90cba62164e7ff38e0ccf78a5ca09",
              "status": "affected",
              "version": "f04d275d94e164d24516c32437c988a323018f63",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.117",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.61",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.10",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: guard dc_sink dereferences in MST mode validation\n\ndm_dp_mst_is_port_support_mode() reads\naconnector-\u003edc_sink-\u003edsc_caps... for the DSC branch-throughput check,\nand get_conv_frl_bw()\u0027s HDMI-PCON FRL-bandwidth path reads\naconnector-\u003edc_sink-\u003eedid_caps.max_frl_rate, both without a NULL\ncheck. dc_sink is cleared asynchronously on MST unplug, and both\nfunctions run from paths that the driver\u0027s own comments document as\nracing that teardown: the connector probe worker\u0027s -\u003emode_valid\ncallback and a compositor\u0027s atomic check, neither of which holds the\nMST manager lock that the teardown path uses. The former does have an\nexisting dsc_aux NULL check, but dsc_aux isn\u0027t reliably cleared in\nevery path that clears dc_sink, so it doesn\u0027t cover this.\n\nFail the port-support check and skip the FRL conversion path when the\nsink is already gone.\n\n(cherry picked from commit 7c3db8da4e039698ae198c870712428644e965c7)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:15:19.556Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0189f725242087679bc9f1bbf77ad086f56a72c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/5684a6c24c0d7c40ef2c4ccb3e4a64cffe76a791"
        },
        {
          "url": "https://git.kernel.org/stable/c/daa0437fe5e451856aaf8fda602a9fc2105bbd54"
        },
        {
          "url": "https://git.kernel.org/stable/c/217f64f348c90cba62164e7ff38e0ccf78a5ca09"
        }
      ],
      "title": "drm/amd/display: guard dc_sink dereferences in MST mode validation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98786",
    "datePublished": "2026-10-18T15:48:22.989Z",
    "dateReserved": "2026-09-25T10:25:14.370Z",
    "dateUpdated": "2026-11-10T18:15:19.556Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}