Refine your search
18338 vulnerabilities found for by Linux
CVE-2026-99216 (GCVE-0-2026-99216)
Vulnerability from cvelistv5
Published
2026-10-28 10:36
Modified
2026-10-28 10:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Drivers: hv: Don't reset VMBus connection state on error/exit paths
In two places, current code forces vmbus_connection.conn_state to
DISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect()
calls vmbus_initiate_unload(), which unloads the VMBus connection
only if the conn_state is CONNECTED. Consequently, the connection
remains and the Hyper-V host might continue to send messages or post
VMBus interrupts.
The problem was introduced in commit 74347a99e73ae ("x86/Hyper-V:
Unload vmbus channel in hv panic callback"), in that
vmbus_initiate_unload() started checking the current connection
state before doing the unload. This commit removed some occurrences
where conn_state was forced to DISCONNECTED, but these two remained,
apparently due to an oversight at the time.
Fix this by not forcing conn_state to DISCONNECTED during VMBus exit,
or if a failure occurs when establishing the connection in the first
place. Whatever value conn_state has at the time is then read by
vmbus_initiate_unload() to determine if there is a connection to
be unloaded.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 74347a99e73ae00b8385f1209aaea193c670f901 Version: 74347a99e73ae00b8385f1209aaea193c670f901 Version: 74347a99e73ae00b8385f1209aaea193c670f901 Version: 5e059fc0f054309036d3f612bc8b0a502ca58545 Version: 9f38f7b46de0747c1909e8c557aa21715dce20c5 Version: caeeb3787167c884b955404a7e669fd77f267e44 Version: 4.19.118 ≤ Version: 5.4.35 ≤ Version: 5.6.7 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hv/connection.c",
"drivers/hv/vmbus_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f47ce27af80b87cc684d5c12b65506af498ac7e5",
"status": "affected",
"version": "74347a99e73ae00b8385f1209aaea193c670f901",
"versionType": "git"
},
{
"lessThan": "3195546a377c2d8d176d837e8baad5ce15d11195",
"status": "affected",
"version": "74347a99e73ae00b8385f1209aaea193c670f901",
"versionType": "git"
},
{
"lessThan": "ec31dc39e835ccde0930daccece8c492d28282fc",
"status": "affected",
"version": "74347a99e73ae00b8385f1209aaea193c670f901",
"versionType": "git"
},
{
"status": "affected",
"version": "5e059fc0f054309036d3f612bc8b0a502ca58545",
"versionType": "git"
},
{
"status": "affected",
"version": "9f38f7b46de0747c1909e8c557aa21715dce20c5",
"versionType": "git"
},
{
"status": "affected",
"version": "caeeb3787167c884b955404a7e669fd77f267e44",
"versionType": "git"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.118",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.35",
"versionType": "semver"
},
{
"lessThan": "5.7",
"status": "affected",
"version": "5.6.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hv/connection.c",
"drivers/hv/vmbus_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.118",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: Don\u0027t reset VMBus connection state on error/exit paths\n\nIn two places, current code forces vmbus_connection.conn_state to\nDISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect()\ncalls vmbus_initiate_unload(), which unloads the VMBus connection\nonly if the conn_state is CONNECTED. Consequently, the connection\nremains and the Hyper-V host might continue to send messages or post\nVMBus interrupts.\n\nThe problem was introduced in commit 74347a99e73ae (\"x86/Hyper-V:\nUnload vmbus channel in hv panic callback\"), in that\nvmbus_initiate_unload() started checking the current connection\nstate before doing the unload. This commit removed some occurrences\nwhere conn_state was forced to DISCONNECTED, but these two remained,\napparently due to an oversight at the time.\n\nFix this by not forcing conn_state to DISCONNECTED during VMBus exit,\nor if a failure occurs when establishing the connection in the first\nplace. Whatever value conn_state has at the time is then read by\nvmbus_initiate_unload() to determine if there is a connection to\nbe unloaded."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:36:09.383Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f47ce27af80b87cc684d5c12b65506af498ac7e5"
},
{
"url": "https://git.kernel.org/stable/c/3195546a377c2d8d176d837e8baad5ce15d11195"
},
{
"url": "https://git.kernel.org/stable/c/ec31dc39e835ccde0930daccece8c492d28282fc"
}
],
"title": "Drivers: hv: Don\u0027t reset VMBus connection state on error/exit paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99216",
"datePublished": "2026-10-28T10:36:09.383Z",
"dateReserved": "2026-09-25T10:25:14.401Z",
"dateUpdated": "2026-10-28T10:36:09.383Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99215 (GCVE-0-2026-99215)
Vulnerability from cvelistv5
Published
2026-10-28 10:36
Modified
2026-10-28 10:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
power: supply: core: prevent unregistering a power supply while a callback runs
Once a power supply is registered, its callbacks can immediately start
firing from other contexts, such as external_power_changed() triggered by
the TCPM stack. If a power supply is unregistered while the callback is
still running, the driver data can already be freed when the callback
tries to access it, leading to a use-after-free.
This happens e.g. when the hardware bus carrying the power supply device
malfunctions (e.g. I2C is hogged down by another malfunctioning device)
immediately after the power supply is registered, and thus the core is
still processing the callbacks which were queued up when the driver
starts the removal, leading in some cases to a kernel crash, e.g.:
[ 11.645942] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000005
[ 11.646751] Mem abort info:
[ 11.647006] ESR = 0x0000000096000004
[ 11.647338] EC = 0x25: DABT (current EL), IL = 32 bits
[ 11.647806] SET = 0, FnV = 0
[ 11.648077] EA = 0, S1PTW = 0
[ 11.648356] FSC = 0x04: level 0 translation fault
[ 11.648785] Data abort info:
[ 11.649041] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
[ 11.649524] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[ 11.649981] GCS = 0, Overlay = 0, DirtyBit = 0
[ 11.650390] [0000000000000005] user address but active_mm is swapper
[ 11.650955] Internal error: Oops: 0000000096000004 [#1] SMP
[ 11.651460] Modules linked in:
[ 11.651742] CPU: 1 UID: 0 PID: 144 Comm: kworker/1:2 Not tainted 7.2.0-rc6-g62a9297af2cd #1 PREEMPT
[ 11.652553] Hardware name: Flipper One rev. F0B1C2 (DT)
[ 11.653024] Workqueue: events power_supply_changed_work
[ 11.653511] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 11.654135] pc : __power_supply_is_supplied_by+0x18/0x100
[ 11.654624] lr : __power_supply_am_i_supplied+0x40/0xb8
[ 11.655098] sp : ffff80008192bb30
[ 11.655399] x29: ffff80008192bb30 x28: 0000000000000000 x27: 0000000000000000
[ 11.656049] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
[ 11.656695] x23: ffff0000c19f4200 x22: ffffdb2232ba4ea8 x21: ffff80008192bc28
[ 11.657344] x20: ffff0000c1eef000 x19: ffff80008192bc18 x18: 00000000a0886e62
[ 11.657991] x17: 000000040044ffff x16: 04500072b5503510 x15: 0000000000000000
[ 11.658639] x14: 0000000000000000 x13: 0000000000000220 x12: 0000000000000000
[ 11.659286] x11: 0000000000000000 x10: ffff0000c1fdb2b0 x9 : ffffdb2232ba5590
[ 11.659934] x8 : 00000000e5b906e6 x7 : ffff0000c2502778 x6 : ffffdb22339793d0
[ 11.660581] x5 : ffff80008192bc18 x4 : ffff0000c19cbca0 x3 : 0000000000000000
[ 11.661228] x2 : ffff0000c1fdaf40 x1 : ffffffffffffffed x0 : ffff0000c1eef000
[ 11.661878] Call trace:
[ 11.662103] __power_supply_is_supplied_by+0x18/0x100 (P)
[ 11.662596] __power_supply_am_i_supplied+0x40/0xb8
[ 11.663040] psy_for_each_psy_cb+0x20/0x40
[ 11.663416] class_for_each_device+0x110/0x150
[ 11.663825] power_supply_am_i_supplied+0x68/0x100
[ 11.664262] bq257xx_external_power_changed+0x58/0x140
[ 11.664733] __power_supply_changed_work+0x60/0x80
[ 11.665170] psy_for_each_psy_cb+0x20/0x40
[ 11.665545] class_for_each_device+0x110/0x150
[ 11.665953] power_supply_changed_work+0x98/0x1b8
[ 11.666382] process_one_work+0x164/0x4c0
[ 11.666758] worker_thread+0x19c/0x320
[ 11.667104] kthread+0x138/0x150
[ 11.667408] ret_from_fork+0x10/0x20
[ 11.667744] Code: d503233f a9bd7bfd 910003fd a90153f3 (f9400c34)
[ 11.668294] ---[ end trace 0000000000000000 ]---
Add a read-write semaphore between external_power_changed() and
power_supply_unregister() to prevent the latter from returning (and thus
the driver from freeing its data) while the callback is still running.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/power/supply/power_supply_core.c",
"include/linux/power_supply.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2ac0256a28e15c4888fa394d1fe66cf7b1d58090",
"status": "affected",
"version": "bc1540561c9ede1efb6d7bf44804676d3d02a3cc",
"versionType": "git"
},
{
"lessThan": "45388e50d14bc161873b14b9a05d4b8b8822fca6",
"status": "affected",
"version": "bc1540561c9ede1efb6d7bf44804676d3d02a3cc",
"versionType": "git"
},
{
"lessThan": "5b4bd13e0552926648a46c2c9a12a24dfaee3715",
"status": "affected",
"version": "bc1540561c9ede1efb6d7bf44804676d3d02a3cc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/power/supply/power_supply_core.c",
"include/linux/power_supply.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: core: prevent unregistering a power supply while a callback runs\n\nOnce a power supply is registered, its callbacks can immediately start\nfiring from other contexts, such as external_power_changed() triggered by\nthe TCPM stack. If a power supply is unregistered while the callback is\nstill running, the driver data can already be freed when the callback\ntries to access it, leading to a use-after-free.\n\nThis happens e.g. when the hardware bus carrying the power supply device\nmalfunctions (e.g. I2C is hogged down by another malfunctioning device)\nimmediately after the power supply is registered, and thus the core is\nstill processing the callbacks which were queued up when the driver\nstarts the removal, leading in some cases to a kernel crash, e.g.:\n\n[ 11.645942] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000005\n[ 11.646751] Mem abort info:\n[ 11.647006] ESR = 0x0000000096000004\n[ 11.647338] EC = 0x25: DABT (current EL), IL = 32 bits\n[ 11.647806] SET = 0, FnV = 0\n[ 11.648077] EA = 0, S1PTW = 0\n[ 11.648356] FSC = 0x04: level 0 translation fault\n[ 11.648785] Data abort info:\n[ 11.649041] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n[ 11.649524] CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n[ 11.649981] GCS = 0, Overlay = 0, DirtyBit = 0\n[ 11.650390] [0000000000000005] user address but active_mm is swapper\n[ 11.650955] Internal error: Oops: 0000000096000004 [#1] SMP\n[ 11.651460] Modules linked in:\n[ 11.651742] CPU: 1 UID: 0 PID: 144 Comm: kworker/1:2 Not tainted 7.2.0-rc6-g62a9297af2cd #1 PREEMPT\n[ 11.652553] Hardware name: Flipper One rev. F0B1C2 (DT)\n[ 11.653024] Workqueue: events power_supply_changed_work\n[ 11.653511] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ 11.654135] pc : __power_supply_is_supplied_by+0x18/0x100\n[ 11.654624] lr : __power_supply_am_i_supplied+0x40/0xb8\n[ 11.655098] sp : ffff80008192bb30\n[ 11.655399] x29: ffff80008192bb30 x28: 0000000000000000 x27: 0000000000000000\n[ 11.656049] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000\n[ 11.656695] x23: ffff0000c19f4200 x22: ffffdb2232ba4ea8 x21: ffff80008192bc28\n[ 11.657344] x20: ffff0000c1eef000 x19: ffff80008192bc18 x18: 00000000a0886e62\n[ 11.657991] x17: 000000040044ffff x16: 04500072b5503510 x15: 0000000000000000\n[ 11.658639] x14: 0000000000000000 x13: 0000000000000220 x12: 0000000000000000\n[ 11.659286] x11: 0000000000000000 x10: ffff0000c1fdb2b0 x9 : ffffdb2232ba5590\n[ 11.659934] x8 : 00000000e5b906e6 x7 : ffff0000c2502778 x6 : ffffdb22339793d0\n[ 11.660581] x5 : ffff80008192bc18 x4 : ffff0000c19cbca0 x3 : 0000000000000000\n[ 11.661228] x2 : ffff0000c1fdaf40 x1 : ffffffffffffffed x0 : ffff0000c1eef000\n[ 11.661878] Call trace:\n[ 11.662103] __power_supply_is_supplied_by+0x18/0x100 (P)\n[ 11.662596] __power_supply_am_i_supplied+0x40/0xb8\n[ 11.663040] psy_for_each_psy_cb+0x20/0x40\n[ 11.663416] class_for_each_device+0x110/0x150\n[ 11.663825] power_supply_am_i_supplied+0x68/0x100\n[ 11.664262] bq257xx_external_power_changed+0x58/0x140\n[ 11.664733] __power_supply_changed_work+0x60/0x80\n[ 11.665170] psy_for_each_psy_cb+0x20/0x40\n[ 11.665545] class_for_each_device+0x110/0x150\n[ 11.665953] power_supply_changed_work+0x98/0x1b8\n[ 11.666382] process_one_work+0x164/0x4c0\n[ 11.666758] worker_thread+0x19c/0x320\n[ 11.667104] kthread+0x138/0x150\n[ 11.667408] ret_from_fork+0x10/0x20\n[ 11.667744] Code: d503233f a9bd7bfd 910003fd a90153f3 (f9400c34)\n[ 11.668294] ---[ end trace 0000000000000000 ]---\n\nAdd a read-write semaphore between external_power_changed() and\npower_supply_unregister() to prevent the latter from returning (and thus\nthe driver from freeing its data) while the callback is still running."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:36:08.618Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2ac0256a28e15c4888fa394d1fe66cf7b1d58090"
},
{
"url": "https://git.kernel.org/stable/c/45388e50d14bc161873b14b9a05d4b8b8822fca6"
},
{
"url": "https://git.kernel.org/stable/c/5b4bd13e0552926648a46c2c9a12a24dfaee3715"
}
],
"title": "power: supply: core: prevent unregistering a power supply while a callback runs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99215",
"datePublished": "2026-10-28T10:36:08.618Z",
"dateReserved": "2026-09-25T10:25:14.401Z",
"dateUpdated": "2026-10-28T10:36:08.618Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99214 (GCVE-0-2026-99214)
Vulnerability from cvelistv5
Published
2026-10-28 10:36
Modified
2026-10-28 10:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: hdmi: Move packet RAM enable to PM runtime
Audio can be triggered by the HPD handler and start up before video has
been restored, calling vc4_hdmi_write_infoframe() for the audio infoframe.
vc4_hdmi_write_infoframe() needs Packet RAM to be on to store the
infoframe, however, if the video hasn't been enabled,
vc4_hdmi_encoder_post_crtc_enable() hasn't been called and therefore, the
Packet RAM can be disabled by the time vc4_hdmi_write_infoframe() executes,
causing the following splat:
[ 201.570266] ------------[ cut here ]------------
[ 201.570293] Packet RAM has to be on to store the packet.
[ 201.570367] WARNING: drivers/gpu/drm/vc4/vc4_hdmi.c:683 at vc4_hdmi_write_infoframe+0x404/0x494 [vc4], CPU#0: wireplumber/1606
[...]
[ 201.658650] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT)
[...]
[ 201.758499] Call trace:
[ 201.760967] vc4_hdmi_write_infoframe+0x404/0x494 [vc4] (P)
[ 201.766607] vc4_hdmi_write_audio_infoframe+0x1c/0x28 [vc4]
[ 201.772247] write_infoframe+0xbc/0x140 [drm_display_helper]
[ 201.777975] drm_atomic_helper_connector_hdmi_update_audio_infoframe+0x80/0xdc [drm_display_helper]
[ 201.787140] vc4_hdmi_audio_prepare+0x4ac/0x570 [vc4]
[ 201.792252] drm_connector_hdmi_audio_prepare+0x24/0x30 [drm_display_helper]
[ 201.799390] hdmi_codec_prepare+0x100/0x160 [snd_soc_hdmi_codec]
[ 201.805471] snd_soc_pcm_dai_prepare+0xd4/0x100 [snd_soc_core]
[ 201.811375] __soc_pcm_prepare+0x60/0x12c [snd_soc_core]
[ 201.816752] soc_pcm_prepare+0x34/0x58 [snd_soc_core]
[ 201.821863] snd_pcm_do_prepare+0x70/0x8c [snd_pcm]
[ 201.826798] snd_pcm_action_nonatomic+0xe4/0x174 [snd_pcm]
[ 201.832350] snd_pcm_prepare+0xc8/0xd8 [snd_pcm]
[ 201.837021] snd_pcm_common_ioctl+0x458/0x614 [snd_pcm]
[ 201.842308] snd_pcm_ioctl+0x30/0x48 [snd_pcm]
[ 201.846802] __arm64_sys_ioctl+0x88/0xd8
[ 201.850769] invoke_syscall+0x48/0xf4
[ 201.854470] el0_svc_common+0x80/0xd8
[ 201.858171] do_el0_svc+0x1c/0x28
[ 201.861520] el0_svc+0x3c/0xb0
[ 201.864605] el0t_64_sync_handler+0x68/0xdc
[ 201.868834] el0t_64_sync+0x198/0x19c
[ 201.872536] ---[ end trace 0000000000000000 ]---
Considering that Packet RAM enable is essentially a power management
configuration, move its enabling/disabling to the Runtime PM hooks.
Note that post_crtc_disable() still stops all infoframes, but keeps Packet
RAM enabled, leaving it to be disabled by runtime suspend.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vc4/vc4_hdmi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6b03e354526f6bad60ed3a7f08fec8b7d29d2f27",
"status": "affected",
"version": "b47a72f30768ffe76e105b3e91ad7022003e8504",
"versionType": "git"
},
{
"lessThan": "6a987992c78e2e04f71e685d1c589f8ea2151fa2",
"status": "affected",
"version": "b47a72f30768ffe76e105b3e91ad7022003e8504",
"versionType": "git"
},
{
"lessThan": "3f57b34485dc01e5a2db60a89a6ae5439a897e53",
"status": "affected",
"version": "b47a72f30768ffe76e105b3e91ad7022003e8504",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vc4/vc4_hdmi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: hdmi: Move packet RAM enable to PM runtime\n\nAudio can be triggered by the HPD handler and start up before video has\nbeen restored, calling vc4_hdmi_write_infoframe() for the audio infoframe.\nvc4_hdmi_write_infoframe() needs Packet RAM to be on to store the\ninfoframe, however, if the video hasn\u0027t been enabled,\nvc4_hdmi_encoder_post_crtc_enable() hasn\u0027t been called and therefore, the\nPacket RAM can be disabled by the time vc4_hdmi_write_infoframe() executes,\ncausing the following splat:\n\n[ 201.570266] ------------[ cut here ]------------\n[ 201.570293] Packet RAM has to be on to store the packet.\n[ 201.570367] WARNING: drivers/gpu/drm/vc4/vc4_hdmi.c:683 at vc4_hdmi_write_infoframe+0x404/0x494 [vc4], CPU#0: wireplumber/1606\n[...]\n[ 201.658650] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT)\n[...]\n[ 201.758499] Call trace:\n[ 201.760967] vc4_hdmi_write_infoframe+0x404/0x494 [vc4] (P)\n[ 201.766607] vc4_hdmi_write_audio_infoframe+0x1c/0x28 [vc4]\n[ 201.772247] write_infoframe+0xbc/0x140 [drm_display_helper]\n[ 201.777975] drm_atomic_helper_connector_hdmi_update_audio_infoframe+0x80/0xdc [drm_display_helper]\n[ 201.787140] vc4_hdmi_audio_prepare+0x4ac/0x570 [vc4]\n[ 201.792252] drm_connector_hdmi_audio_prepare+0x24/0x30 [drm_display_helper]\n[ 201.799390] hdmi_codec_prepare+0x100/0x160 [snd_soc_hdmi_codec]\n[ 201.805471] snd_soc_pcm_dai_prepare+0xd4/0x100 [snd_soc_core]\n[ 201.811375] __soc_pcm_prepare+0x60/0x12c [snd_soc_core]\n[ 201.816752] soc_pcm_prepare+0x34/0x58 [snd_soc_core]\n[ 201.821863] snd_pcm_do_prepare+0x70/0x8c [snd_pcm]\n[ 201.826798] snd_pcm_action_nonatomic+0xe4/0x174 [snd_pcm]\n[ 201.832350] snd_pcm_prepare+0xc8/0xd8 [snd_pcm]\n[ 201.837021] snd_pcm_common_ioctl+0x458/0x614 [snd_pcm]\n[ 201.842308] snd_pcm_ioctl+0x30/0x48 [snd_pcm]\n[ 201.846802] __arm64_sys_ioctl+0x88/0xd8\n[ 201.850769] invoke_syscall+0x48/0xf4\n[ 201.854470] el0_svc_common+0x80/0xd8\n[ 201.858171] do_el0_svc+0x1c/0x28\n[ 201.861520] el0_svc+0x3c/0xb0\n[ 201.864605] el0t_64_sync_handler+0x68/0xdc\n[ 201.868834] el0t_64_sync+0x198/0x19c\n[ 201.872536] ---[ end trace 0000000000000000 ]---\n\nConsidering that Packet RAM enable is essentially a power management\nconfiguration, move its enabling/disabling to the Runtime PM hooks.\n\nNote that post_crtc_disable() still stops all infoframes, but keeps Packet\nRAM enabled, leaving it to be disabled by runtime suspend."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:36:07.867Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6b03e354526f6bad60ed3a7f08fec8b7d29d2f27"
},
{
"url": "https://git.kernel.org/stable/c/6a987992c78e2e04f71e685d1c589f8ea2151fa2"
},
{
"url": "https://git.kernel.org/stable/c/3f57b34485dc01e5a2db60a89a6ae5439a897e53"
}
],
"title": "drm/vc4: hdmi: Move packet RAM enable to PM runtime",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99214",
"datePublished": "2026-10-28T10:36:07.867Z",
"dateReserved": "2026-09-25T10:25:14.401Z",
"dateUpdated": "2026-10-28T10:36:07.867Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99213 (GCVE-0-2026-99213)
Vulnerability from cvelistv5
Published
2026-10-28 10:36
Modified
2026-10-28 10:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
vsock: treat TCP_CLOSING as once-established
Handle the TCP_ESTABLISHED -> TCP_CLOSING transition on OP_RST, which can
race with the connect loop. Immediately break and return 0 on
ESTABLISHED/CLOSING. The return value of connect() should reflect what
happened up to the point the connection was established or failed. Events
that occur afterwards must not affect it. E.g. even if OP_RW has already
set sk_err, connect() should still return 0, not ENOBUFS because of it.
Adapt the inaccurate comment above signal_pending().
Resetting a socket that is still present in connected_table can lead to
memory corruption. The reporter noted lost transports for in-flight skbs,
and I have reproduced crashes caused by re-insertion into connected_table.
list_add double add: new=, prev=, next=.
kernel BUG at lib/list_debug.c:35!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
Workqueue: vsock-loopback vsock_loopback_work
RIP: 0010:__list_add_valid_or_report+0x11f/0x130
Call Trace:
vsock_insert_connected.cold+0xe/0x13
virtio_transport_recv_pkt+0x10e9/0x1460
vsock_loopback_work+0x305/0x480
process_one_work+0xe4c/0x1560
worker_thread+0x4f1/0xd60
kthread+0x36e/0x470
ret_from_fork+0x47b/0x6b0
ret_from_fork_asm+0x1a/0x30
This fix is supplementary to commit 002541ef650b ("vsock: Ignore
signal/timeout on connect() if already established"). Details under Link.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/vmw_vsock/af_vsock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c2c5359ef2c33684fa3f3652fd761a483db8d1e7",
"status": "affected",
"version": "d021c344051af91f42c5ba9fdedc176740cbd238",
"versionType": "git"
},
{
"lessThan": "44d1ca05d6094a5d75c671a0545249186d790b8d",
"status": "affected",
"version": "d021c344051af91f42c5ba9fdedc176740cbd238",
"versionType": "git"
},
{
"lessThan": "4f6ac74fa594a918d41255c941256e1d51592d3b",
"status": "affected",
"version": "d021c344051af91f42c5ba9fdedc176740cbd238",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/vmw_vsock/af_vsock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.9"
},
{
"lessThan": "3.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock: treat TCP_CLOSING as once-established\n\nHandle the TCP_ESTABLISHED -\u003e TCP_CLOSING transition on OP_RST, which can\nrace with the connect loop. Immediately break and return 0 on\nESTABLISHED/CLOSING. The return value of connect() should reflect what\nhappened up to the point the connection was established or failed. Events\nthat occur afterwards must not affect it. E.g. even if OP_RW has already\nset sk_err, connect() should still return 0, not ENOBUFS because of it.\nAdapt the inaccurate comment above signal_pending().\n\nResetting a socket that is still present in connected_table can lead to\nmemory corruption. The reporter noted lost transports for in-flight skbs,\nand I have reproduced crashes caused by re-insertion into connected_table.\n\n list_add double add: new=, prev=, next=.\n kernel BUG at lib/list_debug.c:35!\n Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\n Workqueue: vsock-loopback vsock_loopback_work\n RIP: 0010:__list_add_valid_or_report+0x11f/0x130\n Call Trace:\n vsock_insert_connected.cold+0xe/0x13\n virtio_transport_recv_pkt+0x10e9/0x1460\n vsock_loopback_work+0x305/0x480\n process_one_work+0xe4c/0x1560\n worker_thread+0x4f1/0xd60\n kthread+0x36e/0x470\n ret_from_fork+0x47b/0x6b0\n ret_from_fork_asm+0x1a/0x30\n\nThis fix is supplementary to commit 002541ef650b (\"vsock: Ignore\nsignal/timeout on connect() if already established\"). Details under Link."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:36:06.441Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c2c5359ef2c33684fa3f3652fd761a483db8d1e7"
},
{
"url": "https://git.kernel.org/stable/c/44d1ca05d6094a5d75c671a0545249186d790b8d"
},
{
"url": "https://git.kernel.org/stable/c/4f6ac74fa594a918d41255c941256e1d51592d3b"
}
],
"title": "vsock: treat TCP_CLOSING as once-established",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99213",
"datePublished": "2026-10-28T10:36:06.441Z",
"dateReserved": "2026-09-25T10:25:14.401Z",
"dateUpdated": "2026-10-28T10:36:06.441Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99212 (GCVE-0-2026-99212)
Vulnerability from cvelistv5
Published
2026-10-28 10:36
Modified
2026-10-28 10:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure
rds_rdma_cm_event_handler_cmn() hands the return value of
rdma_resolve_route() straight back to the rdma_cm on
RDMA_CM_EVENT_ADDR_RESOLVED. A synchronous failure there - -ENOMEM
from the route work allocation, an SA query that cannot be set up, a
RoCE route with no usable device - makes addr_handler() destroy the
id the event was delivered on. That id is ic->i_cm_id, and nothing
clears the pointer: the connection sits in RDS_CONN_CONNECTING with a
freed id until its shutdown calls rdma_disconnect() and
rdma_destroy_id() on it.
The ROUTE_RESOLVED case already avoids this: rds_ib_cm_initiate_connect()
forces a zero return while ic->i_cm_id == cm_id, as the comment there
explains. Do the same here - drop the connection and return 0 - so
the id stays RDS's to destroy from the shutdown, and the reconnect
gets a fresh one.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/rds/rdma_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a7c7d0ff876377fea7ae876a28d6df8d9349df57",
"status": "affected",
"version": "55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea",
"versionType": "git"
},
{
"lessThan": "91ece3efa064f0b3b3c67b9b045d9eeb4a034e43",
"status": "affected",
"version": "55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea",
"versionType": "git"
},
{
"lessThan": "98d446b7c013254a8a7b49720557676a3a851fde",
"status": "affected",
"version": "55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/rds/rdma_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.30"
},
{
"lessThan": "2.6.30",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.30",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: don\u0027t let the rdma_cm destroy an id RDS still owns on route failure\n\nrds_rdma_cm_event_handler_cmn() hands the return value of\nrdma_resolve_route() straight back to the rdma_cm on\nRDMA_CM_EVENT_ADDR_RESOLVED. A synchronous failure there - -ENOMEM\nfrom the route work allocation, an SA query that cannot be set up, a\nRoCE route with no usable device - makes addr_handler() destroy the\nid the event was delivered on. That id is ic-\u003ei_cm_id, and nothing\nclears the pointer: the connection sits in RDS_CONN_CONNECTING with a\nfreed id until its shutdown calls rdma_disconnect() and\nrdma_destroy_id() on it.\n\nThe ROUTE_RESOLVED case already avoids this: rds_ib_cm_initiate_connect()\nforces a zero return while ic-\u003ei_cm_id == cm_id, as the comment there\nexplains. Do the same here - drop the connection and return 0 - so\nthe id stays RDS\u0027s to destroy from the shutdown, and the reconnect\ngets a fresh one."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:36:05.612Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a7c7d0ff876377fea7ae876a28d6df8d9349df57"
},
{
"url": "https://git.kernel.org/stable/c/91ece3efa064f0b3b3c67b9b045d9eeb4a034e43"
},
{
"url": "https://git.kernel.org/stable/c/98d446b7c013254a8a7b49720557676a3a851fde"
}
],
"title": "net/rds: don\u0027t let the rdma_cm destroy an id RDS still owns on route failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99212",
"datePublished": "2026-10-28T10:36:05.612Z",
"dateReserved": "2026-09-25T10:25:14.401Z",
"dateUpdated": "2026-10-28T10:36:05.612Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99211 (GCVE-0-2026-99211)
Vulnerability from cvelistv5
Published
2026-10-28 10:36
Modified
2026-10-28 10:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netlink: reset skb headers before unicast and multicast filtering
Socket filters can use SKF_NET_OFF and SKF_LL_OFF to read relative to
an skb's network and MAC headers. Netlink producers may reserve
headroom without resetting those headers, allowing a receiving socket's
filter to read data before the initialized message.
For example, IWPM HELLO replies are allocated with dev_alloc_skb(),
which reserves NET_SKB_PAD bytes. An unprivileged NETLINK_RDMA user can
attach a classic socket filter and disclose this headroom through the
length of the delivered reply. The resets in netlink_dump() do not help
because IWPM sends a separately allocated skb through netlink_unicast().
Reset both headers before running the receiver's filter in unicast and
broadcast delivery, as is already done for dump skbs. This also covers
other netlink producers that reserve headroom without changing their
allocation or message-building code.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netlink/af_netlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "06791594274f87c29f1a9f1961d700272716a49d",
"status": "affected",
"version": "b1153f29ee07dc1a788964409255a4b4fae50b98",
"versionType": "git"
},
{
"lessThan": "06935da5de83aa8b98841563894857e7d2f80e47",
"status": "affected",
"version": "b1153f29ee07dc1a788964409255a4b4fae50b98",
"versionType": "git"
},
{
"lessThan": "8bf659bd54e1f00e34cf5244b1d289c506fa47c0",
"status": "affected",
"version": "b1153f29ee07dc1a788964409255a4b4fae50b98",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netlink/af_netlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.26"
},
{
"lessThan": "2.6.26",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: reset skb headers before unicast and multicast filtering\n\nSocket filters can use SKF_NET_OFF and SKF_LL_OFF to read relative to\nan skb\u0027s network and MAC headers. Netlink producers may reserve\nheadroom without resetting those headers, allowing a receiving socket\u0027s\nfilter to read data before the initialized message.\n\nFor example, IWPM HELLO replies are allocated with dev_alloc_skb(),\nwhich reserves NET_SKB_PAD bytes. An unprivileged NETLINK_RDMA user can\nattach a classic socket filter and disclose this headroom through the\nlength of the delivered reply. The resets in netlink_dump() do not help\nbecause IWPM sends a separately allocated skb through netlink_unicast().\n\nReset both headers before running the receiver\u0027s filter in unicast and\nbroadcast delivery, as is already done for dump skbs. This also covers\nother netlink producers that reserve headroom without changing their\nallocation or message-building code."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:36:04.864Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/06791594274f87c29f1a9f1961d700272716a49d"
},
{
"url": "https://git.kernel.org/stable/c/06935da5de83aa8b98841563894857e7d2f80e47"
},
{
"url": "https://git.kernel.org/stable/c/8bf659bd54e1f00e34cf5244b1d289c506fa47c0"
}
],
"title": "netlink: reset skb headers before unicast and multicast filtering",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99211",
"datePublished": "2026-10-28T10:36:04.864Z",
"dateReserved": "2026-09-25T10:25:14.401Z",
"dateUpdated": "2026-10-28T10:36:04.864Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99210 (GCVE-0-2026-99210)
Vulnerability from cvelistv5
Published
2026-10-28 10:36
Modified
2026-10-28 10:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
accel/rocket: clear rdev on device init failure
rocket_probe() stores the return value from rocket_device_init() in the
file-scoped rdev pointer before checking whether it is an error pointer.
If rocket_device_init() fails, rdev is left as an ERR_PTR.
The rdev pointer is also used as the marker for whether the shared rocket
device has already been initialized. A later core probe can therefore see
a non-NULL rdev, skip rocket_device_init(), and dereference the error
pointer when reading rdev->num_cores.
Save the error code and clear rdev before returning from the
rocket_device_init() failure path.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/accel/rocket/rocket_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "79071b67182e1b352d51a3917729b8d424710b49",
"status": "affected",
"version": "ed98261b41687323ffa02ca20fef1e60b38fd1aa",
"versionType": "git"
},
{
"lessThan": "dd47a6c920083b069f00f0920e4566915a6aec46",
"status": "affected",
"version": "ed98261b41687323ffa02ca20fef1e60b38fd1aa",
"versionType": "git"
},
{
"lessThan": "4ac852419f0d317c7bd8db5b8acb3cc78be7fe33",
"status": "affected",
"version": "ed98261b41687323ffa02ca20fef1e60b38fd1aa",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/accel/rocket/rocket_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/rocket: clear rdev on device init failure\n\nrocket_probe() stores the return value from rocket_device_init() in the\nfile-scoped rdev pointer before checking whether it is an error pointer.\nIf rocket_device_init() fails, rdev is left as an ERR_PTR.\n\nThe rdev pointer is also used as the marker for whether the shared rocket\ndevice has already been initialized. A later core probe can therefore see\na non-NULL rdev, skip rocket_device_init(), and dereference the error\npointer when reading rdev-\u003enum_cores.\n\nSave the error code and clear rdev before returning from the\nrocket_device_init() failure path."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:36:04.110Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/79071b67182e1b352d51a3917729b8d424710b49"
},
{
"url": "https://git.kernel.org/stable/c/dd47a6c920083b069f00f0920e4566915a6aec46"
},
{
"url": "https://git.kernel.org/stable/c/4ac852419f0d317c7bd8db5b8acb3cc78be7fe33"
}
],
"title": "accel/rocket: clear rdev on device init failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99210",
"datePublished": "2026-10-28T10:36:04.110Z",
"dateReserved": "2026-09-25T10:25:14.401Z",
"dateUpdated": "2026-10-28T10:36:04.110Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99209 (GCVE-0-2026-99209)
Vulnerability from cvelistv5
Published
2026-10-28 10:36
Modified
2026-10-28 10:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: skip eviction of a BO with no resource
xe_evict_flags() switches on tbo->resource->mem_type to choose an
eviction placement. An xe BO can reach eviction with no ttm.resource,
e.g. an imported dma-buf BO whose resource was freed during teardown
while its attachment is still live: the exporter then invalidates it via
xe_dma_buf_move_notify() -> xe_bo_evict(), and the switch dereferences a
NULL resource and faults.
A BO with no resource has nothing placed or mapped, so there is nothing
to evict. Return an empty placement (num_placement = 0), mirroring the
handling already used for non-xe scatter-gather BOs just above;
ttm_bo_validate() then takes the pipeline-gutting path and returns 0.
Without the fix the xe_dma_buf@xe_test_dmabuf_move_notify_no_resource
dynamic live selftest will fail with below stack.
BUG: kernel NULL pointer dereference, address: 0000000000000010
RIP: 0010:xe_evict_flags+0xf4/0x140 [xe]
Call Trace:
<TASK>
xe_bo_evict+0x40/0xa0 [xe]
? ttm_bo_pipeline_gutting+0x71/0x180 [ttm]
xe_test_dmabuf_move_notify_no_resource+0x182/0x440 [xe]
xe_dma_buf_kunit+0x387/0x580 [xe]
v2: Add Fixes tag and failure info in commit text (Matt Brost)
(cherry picked from commit dbcfaac6331f1fcb0c2fe3ad3e9adb1e5d43ec0c)
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_bo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6046bb9cb2859e3d9bf939e4d6527f3827e1096f",
"status": "affected",
"version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
"versionType": "git"
},
{
"lessThan": "b6499d19ade1f1e4a1e6b739abc8c815297c98b8",
"status": "affected",
"version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
"versionType": "git"
},
{
"lessThan": "448e76cbdc6652ccd3ba337b7a6e1f028859f2ed",
"status": "affected",
"version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_bo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: skip eviction of a BO with no resource\n\nxe_evict_flags() switches on tbo-\u003eresource-\u003emem_type to choose an\neviction placement. An xe BO can reach eviction with no ttm.resource,\ne.g. an imported dma-buf BO whose resource was freed during teardown\nwhile its attachment is still live: the exporter then invalidates it via\nxe_dma_buf_move_notify() -\u003e xe_bo_evict(), and the switch dereferences a\nNULL resource and faults.\n\nA BO with no resource has nothing placed or mapped, so there is nothing\nto evict. Return an empty placement (num_placement = 0), mirroring the\nhandling already used for non-xe scatter-gather BOs just above;\nttm_bo_validate() then takes the pipeline-gutting path and returns 0.\n\nWithout the fix the xe_dma_buf@xe_test_dmabuf_move_notify_no_resource\ndynamic live selftest will fail with below stack.\n\nBUG: kernel NULL pointer dereference, address: 0000000000000010\nRIP: 0010:xe_evict_flags+0xf4/0x140 [xe]\nCall Trace:\n \u003cTASK\u003e\n xe_bo_evict+0x40/0xa0 [xe]\n ? ttm_bo_pipeline_gutting+0x71/0x180 [ttm]\n xe_test_dmabuf_move_notify_no_resource+0x182/0x440 [xe]\n xe_dma_buf_kunit+0x387/0x580 [xe]\n\nv2: Add Fixes tag and failure info in commit text (Matt Brost)\n\n(cherry picked from commit dbcfaac6331f1fcb0c2fe3ad3e9adb1e5d43ec0c)"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:36:03.274Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6046bb9cb2859e3d9bf939e4d6527f3827e1096f"
},
{
"url": "https://git.kernel.org/stable/c/b6499d19ade1f1e4a1e6b739abc8c815297c98b8"
},
{
"url": "https://git.kernel.org/stable/c/448e76cbdc6652ccd3ba337b7a6e1f028859f2ed"
}
],
"title": "drm/xe: skip eviction of a BO with no resource",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99209",
"datePublished": "2026-10-28T10:36:03.274Z",
"dateReserved": "2026-09-25T10:25:14.401Z",
"dateUpdated": "2026-10-28T10:36:03.274Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99208 (GCVE-0-2026-99208)
Vulnerability from cvelistv5
Published
2026-10-28 10:36
Modified
2026-10-28 10:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/oa: Zero OA buffer at allocation
ttm_bo_type_kernel BOs are not guaranteed to be zeroed on allocation and
may contain data from previously freed pages. Since the OA buffer is
mmap'able by userspace, this can expose stale kernel memory contents.
Streams opened with DRM_XE_OA_PROPERTY_OA_DISABLED allocate the OA
buffer without calling xe_oa_init_oa_buffer(). Zero the buffer at
allocation to prevent information disclosure through mmap.
The existing zeroing in xe_oa_init_oa_buffer() remains necessary for
zero report-id/timestamp detection on enable/re-enable.
(cherry picked from commit 126c4c5388f9311a390b9b254a835b0cf0f55331)
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_oa.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "21f41b6daf0dbe2cdaaf9f54af6e23fd3c9190b9",
"status": "affected",
"version": "392bf22238ff88506f410c464ba0c7a84e9de471",
"versionType": "git"
},
{
"lessThan": "cd3e2918c247db631d88cdd704596d9d27e5513e",
"status": "affected",
"version": "392bf22238ff88506f410c464ba0c7a84e9de471",
"versionType": "git"
},
{
"lessThan": "fd8662823caa114a63f07222d2aa448f6ac5e864",
"status": "affected",
"version": "392bf22238ff88506f410c464ba0c7a84e9de471",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_oa.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/oa: Zero OA buffer at allocation\n\nttm_bo_type_kernel BOs are not guaranteed to be zeroed on allocation and\nmay contain data from previously freed pages. Since the OA buffer is\nmmap\u0027able by userspace, this can expose stale kernel memory contents.\n\nStreams opened with DRM_XE_OA_PROPERTY_OA_DISABLED allocate the OA\nbuffer without calling xe_oa_init_oa_buffer(). Zero the buffer at\nallocation to prevent information disclosure through mmap.\n\nThe existing zeroing in xe_oa_init_oa_buffer() remains necessary for\nzero report-id/timestamp detection on enable/re-enable.\n\n(cherry picked from commit 126c4c5388f9311a390b9b254a835b0cf0f55331)"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:36:01.473Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/21f41b6daf0dbe2cdaaf9f54af6e23fd3c9190b9"
},
{
"url": "https://git.kernel.org/stable/c/cd3e2918c247db631d88cdd704596d9d27e5513e"
},
{
"url": "https://git.kernel.org/stable/c/fd8662823caa114a63f07222d2aa448f6ac5e864"
}
],
"title": "drm/xe/oa: Zero OA buffer at allocation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99208",
"datePublished": "2026-10-28T10:36:01.473Z",
"dateReserved": "2026-09-25T10:25:14.401Z",
"dateUpdated": "2026-10-28T10:36:01.473Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99207 (GCVE-0-2026-99207)
Vulnerability from cvelistv5
Published
2026-10-28 10:36
Modified
2026-10-28 10:36
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: Disable interrupts while holding delayed_cmd_lock
target_do_delayed_work() takes dev->delayed_cmd_lock with a plain
spin_lock(). It runs from system_percpu_wq, so interrupts stay enabled
while the lock is held. Every other acquisition of that lock uses
spin_lock_irqsave(): target_handle_task_attr() and
transport_complete_ordered_sync() in target_core_transport.c, and
target_non_ordered_release() in target_core_device.c.
That was safe while every caller of transport_complete_task_attr() ran
in process context: target_complete_ok_work() from target_completion_wq,
transport_complete_qf() from dev->qf_work_queue, and
transport_generic_request_failure() from the submit and execute paths.
Since commit 06933066d88a ("scsi: target: Add support for completing
commands from backend context") that is no longer true. With
complete_type=1 on a fabric that sets direct_compl_supp,
target_complete() runs target_complete_ok_work() inline in the backend's
completion context, which target_complete_cmd_with_sense() documents as
"May be called from interrupt context". For iblock that is the bio
end_io.
target_complete_ok_work() starts with transport_complete_task_attr(),
which takes delayed_cmd_lock in two ways:
- Every ORDERED command is put on dev->delayed_cmd_list by
target_handle_task_attr() and dispatched from there by
target_do_delayed_work(), which marks it SCF_TASK_ORDERED_SYNC. Its
completion therefore goes through transport_complete_ordered_sync().
- A SIMPLE command that completes while an ORDERED command is pending
drops the last reference to the killed dev->non_ordered, and
percpu_ref_put() then runs target_non_ordered_release() in the
completing context.
Both take the lock and, if commands are waiting, call
schedule_work(&dev->delayed_cmd_work), which queues on system_percpu_wq,
i.e. on the CPU that took the completion. Further completions for the
same queue are typically delivered there too, so one arriving while the
work holds the lock spins on it forever.
Reaching this needs complete_type=1, which is not the default
(vhost-scsi, the only fabric with direct_compl_supp, defaults to
TARGET_QUEUE_COMPL), a backend whose I/O completes from interrupt
context, and ORDERED commands from the initiator. Linux virtio_scsi
guests send only VIRTIO_SCSI_S_SIMPLE and never take the ordered path;
any guest that uses the ORDERED task attribute, which vhost-scsi
accepts, does.
target_do_delayed_work() is a work item and always runs in process
context, so spin_lock_irq() is sufficient.
Found by inspection; no runtime report. A single ORDERED command goes
through both acquisitions, so with CONFIG_PROVE_LOCKING the first one
completed through direct completion should produce an inconsistent lock
state report on delayed_cmd_lock (hardirq or softirq, depending on where
the backend completes).
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/target/target_core_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7563650522732041ccfb2e4593878b5ea98d498c",
"status": "affected",
"version": "06933066d88a3093953b062922c016a67d2cdbf8",
"versionType": "git"
},
{
"lessThan": "04a67a8b1a4460345d22fe75d93430cbf7e651d7",
"status": "affected",
"version": "06933066d88a3093953b062922c016a67d2cdbf8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/target/target_core_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: Disable interrupts while holding delayed_cmd_lock\n\ntarget_do_delayed_work() takes dev-\u003edelayed_cmd_lock with a plain\nspin_lock(). It runs from system_percpu_wq, so interrupts stay enabled\nwhile the lock is held. Every other acquisition of that lock uses\nspin_lock_irqsave(): target_handle_task_attr() and\ntransport_complete_ordered_sync() in target_core_transport.c, and\ntarget_non_ordered_release() in target_core_device.c.\n\nThat was safe while every caller of transport_complete_task_attr() ran\nin process context: target_complete_ok_work() from target_completion_wq,\ntransport_complete_qf() from dev-\u003eqf_work_queue, and\ntransport_generic_request_failure() from the submit and execute paths.\n\nSince commit 06933066d88a (\"scsi: target: Add support for completing\ncommands from backend context\") that is no longer true. With\ncomplete_type=1 on a fabric that sets direct_compl_supp,\ntarget_complete() runs target_complete_ok_work() inline in the backend\u0027s\ncompletion context, which target_complete_cmd_with_sense() documents as\n\"May be called from interrupt context\". For iblock that is the bio\nend_io.\n\ntarget_complete_ok_work() starts with transport_complete_task_attr(),\nwhich takes delayed_cmd_lock in two ways:\n\n - Every ORDERED command is put on dev-\u003edelayed_cmd_list by\n target_handle_task_attr() and dispatched from there by\n target_do_delayed_work(), which marks it SCF_TASK_ORDERED_SYNC. Its\n completion therefore goes through transport_complete_ordered_sync().\n\n - A SIMPLE command that completes while an ORDERED command is pending\n drops the last reference to the killed dev-\u003enon_ordered, and\n percpu_ref_put() then runs target_non_ordered_release() in the\n completing context.\n\nBoth take the lock and, if commands are waiting, call\nschedule_work(\u0026dev-\u003edelayed_cmd_work), which queues on system_percpu_wq,\ni.e. on the CPU that took the completion. Further completions for the\nsame queue are typically delivered there too, so one arriving while the\nwork holds the lock spins on it forever.\n\nReaching this needs complete_type=1, which is not the default\n(vhost-scsi, the only fabric with direct_compl_supp, defaults to\nTARGET_QUEUE_COMPL), a backend whose I/O completes from interrupt\ncontext, and ORDERED commands from the initiator. Linux virtio_scsi\nguests send only VIRTIO_SCSI_S_SIMPLE and never take the ordered path;\nany guest that uses the ORDERED task attribute, which vhost-scsi\naccepts, does.\n\ntarget_do_delayed_work() is a work item and always runs in process\ncontext, so spin_lock_irq() is sufficient.\n\nFound by inspection; no runtime report. A single ORDERED command goes\nthrough both acquisitions, so with CONFIG_PROVE_LOCKING the first one\ncompleted through direct completion should produce an inconsistent lock\nstate report on delayed_cmd_lock (hardirq or softirq, depending on where\nthe backend completes)."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:36:00.728Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7563650522732041ccfb2e4593878b5ea98d498c"
},
{
"url": "https://git.kernel.org/stable/c/04a67a8b1a4460345d22fe75d93430cbf7e651d7"
}
],
"title": "scsi: target: Disable interrupts while holding delayed_cmd_lock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99207",
"datePublished": "2026-10-28T10:36:00.728Z",
"dateReserved": "2026-09-25T10:25:14.401Z",
"dateUpdated": "2026-10-28T10:36:00.728Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99206 (GCVE-0-2026-99206)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-28 10:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: iscsi: Fix race in discovery auth updates
Separate configfs opens can concurrently update the discovery AuthMethod
parameter. Both callers may free the same value in
iscsi_update_param_value(), causing a double-free.
Protect the lookup and replacement with the discovery TPG access lock,
as used by the other TPG configfs parameter updates.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/target/iscsi/iscsi_target_configfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9b07828b133b326cb4fb59f144ca37f8db535999",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
},
{
"lessThan": "6caa2b3edb7da4f50a38e16561b75fcae21d4099",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
},
{
"lessThan": "e15b81f602edbdee39c335546f25486a1747f3f0",
"status": "affected",
"version": "e48354ce078c079996f89d715dfa44814b4eba01",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/target/iscsi/iscsi_target_configfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.1"
},
{
"lessThan": "3.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: iscsi: Fix race in discovery auth updates\n\nSeparate configfs opens can concurrently update the discovery AuthMethod\nparameter. Both callers may free the same value in\niscsi_update_param_value(), causing a double-free.\n\nProtect the lookup and replacement with the discovery TPG access lock,\nas used by the other TPG configfs parameter updates."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:35:59.851Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9b07828b133b326cb4fb59f144ca37f8db535999"
},
{
"url": "https://git.kernel.org/stable/c/6caa2b3edb7da4f50a38e16561b75fcae21d4099"
},
{
"url": "https://git.kernel.org/stable/c/e15b81f602edbdee39c335546f25486a1747f3f0"
}
],
"title": "scsi: target: iscsi: Fix race in discovery auth updates",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99206",
"datePublished": "2026-10-28T10:35:59.851Z",
"dateReserved": "2026-09-25T10:25:14.401Z",
"dateUpdated": "2026-10-28T10:35:59.851Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99205 (GCVE-0-2026-99205)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-28 10:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sched/core: Call wakeup_preempt() for queued tasks during class change
Paul reported recent RCU changes exposed a lost resched where CPU idles
with a rcutorture thread waiting while being completely runnable.
Dumping the rq state at the time of idling with runnable tasks showed
the following:
rq->next_class = &fair_sched_class
rq->nr_running = 1
rq->cfs.h_nr_queued = 0
rq->rt.rt_nr_running = 1
Although the waiting task was an RT task, "rq->next_class" did not point
to rt_sched_class and was stuck at the lower priority fair_sched_class.
Inspecting sched_change_end() revealed the following race with
__sched_setscheduler() for queued, but non-running tasks:
CPU0 CPU1
==== ====
__schedule()
/*
* rq->donor is a fair task that blocks.
* rq->next_class = &fair_sched_class
*/
rq_lock(rq0)
pick_next_task()
/* nr_running = 0 */
pick_task_fair()
sched_balance_newidle()
raw_spin_rq_unlock(rq0)
rq_lock(rq0)
activate_task(rq0, p)
/* p is a fair task */
rq0->nr_running++;
rq0->cfs.h_nr_queued++;
wakeup_preempt(rq, p)
rq->next_class = &fair_sched_class
resched_curr()
rq_unlock(rq0)
__sched_setscheduler(p)
/* p is moved to SCHED_RR */
task_rq_lock(p)
sched_change_begin()
rq0->cfs.h_nr_queued--;
rq0->rt.rt_nr_running++;
sched_change_end()
/*
* p->on_rq = 1 (ctx->queued)
* but p is not rq->donor
* (!ctx->running) hence
* resched_curr() is and
* rq->next_class upgrade is
* skipped.
*/
task_rq_unlock()
raw_spin_rq_lock(rq0)
/*
* rq->nr_running = 1
* rq->cfs.h_nr_queued = 0
* rq->rt.rt_nr_running = 1
* rq->next_class = &fair_sched_class
*/
if (rq->cfs.h_nr_queued && ...)
/* Above is false */
if (rq_modified_above(this_rq, &fair_sched_class))
/* Also false since rq->next_class is still fair */
/*
* sched_balance_newidle() is considered to
* have failed to pull any fair tasks and no
* other wakeups were detected.
*/
return NULL; /* pick_task_fair() */
pick_task_idle()
return rq->idle;
next = rq->idle;
/* Preemption indicators are lost */
clear_tsk_need_resched(prev);
clear_preempt_need_resched();
rq->curr = rq->idle;
!!! rq->idle switches in with rq->running == 1 but !need_resched() !!!
In simple words, enqueue, followed by a class change of the newly queued
task goes unnoticed in rq->next_class indicator and
sched_balance_newidle() sees no fair task, nor any higher priority task
enqueued.
The above sequence will lead to CPU idling with a runnable task on the
CPU.
Call wakeup_preempt() for ctx->queued cases in sched_change_end() to
re-evaluate rq->next_class after class change (ENQUEUE_CLASS) and set
the NEED_RESCHED indicator accordingly.
Newidle balance will correctly see an enqueue of a higher priority
t
---truncated---
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/sched/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ae89744c5ebf299bf55ac7581768fbd9f119a903",
"status": "affected",
"version": "704069649b5bfb7bf1fe32c0281fe9036806a59a",
"versionType": "git"
},
{
"lessThan": "118a2cf4ced60777a2408001e2b4838fed1cea55",
"status": "affected",
"version": "704069649b5bfb7bf1fe32c0281fe9036806a59a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/sched/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/core: Call wakeup_preempt() for queued tasks during class change\n\nPaul reported recent RCU changes exposed a lost resched where CPU idles\nwith a rcutorture thread waiting while being completely runnable.\n\nDumping the rq state at the time of idling with runnable tasks showed\nthe following:\n\n rq-\u003enext_class = \u0026fair_sched_class\n rq-\u003enr_running = 1\n rq-\u003ecfs.h_nr_queued = 0\n rq-\u003ert.rt_nr_running = 1\n\nAlthough the waiting task was an RT task, \"rq-\u003enext_class\" did not point\nto rt_sched_class and was stuck at the lower priority fair_sched_class.\n\nInspecting sched_change_end() revealed the following race with\n__sched_setscheduler() for queued, but non-running tasks:\n\n CPU0 CPU1\n ==== ====\n\n __schedule()\n\n /*\n * rq-\u003edonor is a fair task that blocks.\n * rq-\u003enext_class = \u0026fair_sched_class\n */\n\n rq_lock(rq0)\n\n pick_next_task()\n /* nr_running = 0 */\n pick_task_fair()\n sched_balance_newidle()\n raw_spin_rq_unlock(rq0)\n rq_lock(rq0)\n\n activate_task(rq0, p)\n /* p is a fair task */\n rq0-\u003enr_running++;\n rq0-\u003ecfs.h_nr_queued++;\n wakeup_preempt(rq, p)\n rq-\u003enext_class = \u0026fair_sched_class\n resched_curr()\n\n rq_unlock(rq0)\n\n __sched_setscheduler(p)\n /* p is moved to SCHED_RR */\n task_rq_lock(p)\n sched_change_begin()\n\n\t\t\t\t rq0-\u003ecfs.h_nr_queued--;\n\t\t\t\t rq0-\u003ert.rt_nr_running++;\n\n sched_change_end()\n /*\n * p-\u003eon_rq = 1 (ctx-\u003equeued)\n * but p is not rq-\u003edonor\n * (!ctx-\u003erunning) hence\n * resched_curr() is and\n * rq-\u003enext_class upgrade is\n * skipped.\n */\n\n task_rq_unlock()\n\n raw_spin_rq_lock(rq0)\n\n /*\n * rq-\u003enr_running = 1\n * rq-\u003ecfs.h_nr_queued = 0\n * rq-\u003ert.rt_nr_running = 1\n * rq-\u003enext_class = \u0026fair_sched_class\n */\n\n if (rq-\u003ecfs.h_nr_queued \u0026\u0026 ...)\n /* Above is false */\n\n if (rq_modified_above(this_rq, \u0026fair_sched_class))\n /* Also false since rq-\u003enext_class is still fair */\n\n /*\n * sched_balance_newidle() is considered to\n * have failed to pull any fair tasks and no\n * other wakeups were detected.\n */\n return NULL; /* pick_task_fair() */\n\n pick_task_idle()\n return rq-\u003eidle;\n\n next = rq-\u003eidle;\n\n /* Preemption indicators are lost */\n clear_tsk_need_resched(prev);\n clear_preempt_need_resched();\n\n rq-\u003ecurr = rq-\u003eidle;\n\n !!! rq-\u003eidle switches in with rq-\u003erunning == 1 but !need_resched() !!!\n\nIn simple words, enqueue, followed by a class change of the newly queued\ntask goes unnoticed in rq-\u003enext_class indicator and\nsched_balance_newidle() sees no fair task, nor any higher priority task\nenqueued.\n\nThe above sequence will lead to CPU idling with a runnable task on the\nCPU.\n\nCall wakeup_preempt() for ctx-\u003equeued cases in sched_change_end() to\nre-evaluate rq-\u003enext_class after class change (ENQUEUE_CLASS) and set\nthe NEED_RESCHED indicator accordingly.\n\nNewidle balance will correctly see an enqueue of a higher priority\nt\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:35:59.093Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ae89744c5ebf299bf55ac7581768fbd9f119a903"
},
{
"url": "https://git.kernel.org/stable/c/118a2cf4ced60777a2408001e2b4838fed1cea55"
}
],
"title": "sched/core: Call wakeup_preempt() for queued tasks during class change",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99205",
"datePublished": "2026-10-28T10:35:59.093Z",
"dateReserved": "2026-09-25T10:25:14.401Z",
"dateUpdated": "2026-10-28T10:35:59.093Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99204 (GCVE-0-2026-99204)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-28 10:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ocfs2/dlm: Protect the recovery list during debugfs reads
Recovery participant records must remain alive while debug_state_print()
walks reco.node_data and formats their fields. The formatter holds
dlm->spinlock, but the recovery participant list is protected by
dlm_reco_state_lock. In particular, dlm_destroy_recovery_area() detaches
the list under dlm_reco_state_lock and frees the detached records after
releasing it. A concurrent debugfs open can therefore read freed memory.
Protect the participant traversal and field reads in debug_state_print()
with dlm_reco_state_lock, matching the existing list writers. This also
serializes the traversal against list_add_tail() during recovery-area
initialization. Make the existing lock available to the debug code
through dlmcommon.h; the lock remains internal to the OCFS2 DLM module.
Release dlm->spinlock after formatting the other domain state and before
acquiring dlm_reco_state_lock, so the debug reader does not nest the two
locks. Leave recovery list insertion, detachment and freeing unchanged.
KASAN report as below:
BUG: KASAN: slab-use-after-free in debug_state_open+0x1169/0x12d0
Read of size 4 at addr ffff88810662ef80 by task dlm-state-stres/896
CPU: 1 UID: 0 PID: 896 Comm: dlm-state-stres Not tainted 7.3.0-rc4-next-20260921-pmb-ocfs2-functional-v1+ #1 PREEMPT(lazy)
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x93/0xd0
print_report+0xce/0x630
? debug_state_open+0x1169/0x12d0
? srso_alias_return_thunk+0x5/0xfbef5
? __virt_addr_valid+0x20e/0x420
? debug_state_open+0x1169/0x12d0
kasan_report+0xe0/0x110
? debug_state_open+0x1169/0x12d0
debug_state_open+0x1169/0x12d0
? __pfx_debug_state_open+0x10/0x10
full_proxy_open_regular+0x193/0x310
do_dentry_open+0x595/0x12d0
? __pfx_full_proxy_open_regular+0x10/0x10
vfs_open_consume+0xd1/0x400
? srso_alias_return_thunk+0x5/0xfbef5
path_openat+0x18d0/0x2020
? __pfx_path_openat+0x10/0x10
do_file_open+0x21e/0x470
? __pfx_do_file_open+0x10/0x10
? _raw_spin_unlock+0x23/0x40
? srso_alias_return_thunk+0x5/0xfbef5
? alloc_fd+0x3a6/0x6b0
do_sys_openat2+0xf4/0x1b0
? __pfx_do_sys_openat2+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? __fput+0x5b5/0xa60
__x64_sys_openat+0x136/0x1e0
? __pfx___x64_sys_openat+0x10/0x10
do_syscall_64+0x114/0x620
entry_SYSCALL_64_after_hwframe+0x77/0x7f
[Register dump omitted.]
</TASK>
Allocated by task 880:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
__kasan_kmalloc+0xaa/0xb0
__kmalloc_cache_noprof+0x28d/0x610
dlm_remaster_locks+0x147/0x1d90
dlm_do_recovery+0xde1/0x1580
dlm_recovery_thread+0x109/0x300
kthread+0x351/0x460
ret_from_fork+0x659/0x940
ret_from_fork_asm+0x1a/0x30
Freed by task 880:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x5f/0x80
kfree+0x308/0x580
dlm_destroy_recovery_area+0x285/0x460
dlm_remaster_locks+0x17c4/0x1d90
dlm_do_recovery+0xde1/0x1580
dlm_recovery_thread+0x109/0x300
kthread+0x351/0x460
ret_from_fork+0x659/0x940
ret_from_fork_asm+0x1a/0x30
The buggy address belongs to the object at ffff88810662ef80
which belongs to the cache kmalloc-32 of size 32
The buggy address is located 0 bytes inside of
freed 32-byte region [ffff88810662ef80, ffff88810662efa0)
[Page and memory-state dumps omitted.]
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/dlm/dlmcommon.h",
"fs/ocfs2/dlm/dlmdebug.c",
"fs/ocfs2/dlm/dlmrecovery.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "04d4571c00db61a9664f387752fa05cb3c08a537",
"status": "affected",
"version": "007dce53a29ccffc000ab5373d188f73881390fd",
"versionType": "git"
},
{
"lessThan": "2bc426a32bfb78868c7f76d9547132837b6b5284",
"status": "affected",
"version": "007dce53a29ccffc000ab5373d188f73881390fd",
"versionType": "git"
},
{
"lessThan": "4c435828932bf46f29860e4a0375bcae101b778a",
"status": "affected",
"version": "007dce53a29ccffc000ab5373d188f73881390fd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/dlm/dlmcommon.h",
"fs/ocfs2/dlm/dlmdebug.c",
"fs/ocfs2/dlm/dlmrecovery.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.26"
},
{
"lessThan": "2.6.26",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2/dlm: Protect the recovery list during debugfs reads\n\nRecovery participant records must remain alive while debug_state_print()\nwalks reco.node_data and formats their fields. The formatter holds\ndlm-\u003espinlock, but the recovery participant list is protected by\ndlm_reco_state_lock. In particular, dlm_destroy_recovery_area() detaches\nthe list under dlm_reco_state_lock and frees the detached records after\nreleasing it. A concurrent debugfs open can therefore read freed memory.\n\nProtect the participant traversal and field reads in debug_state_print()\nwith dlm_reco_state_lock, matching the existing list writers. This also\nserializes the traversal against list_add_tail() during recovery-area\ninitialization. Make the existing lock available to the debug code\nthrough dlmcommon.h; the lock remains internal to the OCFS2 DLM module.\n\nRelease dlm-\u003espinlock after formatting the other domain state and before\nacquiring dlm_reco_state_lock, so the debug reader does not nest the two\nlocks. Leave recovery list insertion, detachment and freeing unchanged.\n\nKASAN report as below:\n\n BUG: KASAN: slab-use-after-free in debug_state_open+0x1169/0x12d0\n Read of size 4 at addr ffff88810662ef80 by task dlm-state-stres/896\n\n CPU: 1 UID: 0 PID: 896 Comm: dlm-state-stres Not tainted 7.3.0-rc4-next-20260921-pmb-ocfs2-functional-v1+ #1 PREEMPT(lazy)\n Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x93/0xd0\n print_report+0xce/0x630\n ? debug_state_open+0x1169/0x12d0\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __virt_addr_valid+0x20e/0x420\n ? debug_state_open+0x1169/0x12d0\n kasan_report+0xe0/0x110\n ? debug_state_open+0x1169/0x12d0\n debug_state_open+0x1169/0x12d0\n ? __pfx_debug_state_open+0x10/0x10\n full_proxy_open_regular+0x193/0x310\n do_dentry_open+0x595/0x12d0\n ? __pfx_full_proxy_open_regular+0x10/0x10\n vfs_open_consume+0xd1/0x400\n ? srso_alias_return_thunk+0x5/0xfbef5\n path_openat+0x18d0/0x2020\n ? __pfx_path_openat+0x10/0x10\n do_file_open+0x21e/0x470\n ? __pfx_do_file_open+0x10/0x10\n ? _raw_spin_unlock+0x23/0x40\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? alloc_fd+0x3a6/0x6b0\n do_sys_openat2+0xf4/0x1b0\n ? __pfx_do_sys_openat2+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __fput+0x5b5/0xa60\n __x64_sys_openat+0x136/0x1e0\n ? __pfx___x64_sys_openat+0x10/0x10\n do_syscall_64+0x114/0x620\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n [Register dump omitted.]\n \u003c/TASK\u003e\n\n Allocated by task 880:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0xaa/0xb0\n __kmalloc_cache_noprof+0x28d/0x610\n dlm_remaster_locks+0x147/0x1d90\n dlm_do_recovery+0xde1/0x1580\n dlm_recovery_thread+0x109/0x300\n kthread+0x351/0x460\n ret_from_fork+0x659/0x940\n ret_from_fork_asm+0x1a/0x30\n\n Freed by task 880:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x5f/0x80\n kfree+0x308/0x580\n dlm_destroy_recovery_area+0x285/0x460\n dlm_remaster_locks+0x17c4/0x1d90\n dlm_do_recovery+0xde1/0x1580\n dlm_recovery_thread+0x109/0x300\n kthread+0x351/0x460\n ret_from_fork+0x659/0x940\n ret_from_fork_asm+0x1a/0x30\n\n The buggy address belongs to the object at ffff88810662ef80\n which belongs to the cache kmalloc-32 of size 32\n The buggy address is located 0 bytes inside of\n freed 32-byte region [ffff88810662ef80, ffff88810662efa0)\n\n [Page and memory-state dumps omitted.]"
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:35:58.336Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/04d4571c00db61a9664f387752fa05cb3c08a537"
},
{
"url": "https://git.kernel.org/stable/c/2bc426a32bfb78868c7f76d9547132837b6b5284"
},
{
"url": "https://git.kernel.org/stable/c/4c435828932bf46f29860e4a0375bcae101b778a"
}
],
"title": "ocfs2/dlm: Protect the recovery list during debugfs reads",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99204",
"datePublished": "2026-10-28T10:35:58.336Z",
"dateReserved": "2026-09-25T10:25:14.400Z",
"dateUpdated": "2026-10-28T10:35:58.336Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99203 (GCVE-0-2026-99203)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-28 10:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
pipe: preserve existing fasync readers on writer setup failure
F_SETFL and FIOASYNC decide whether to invoke ->fasync() before
pipe_fasync() takes pipe->mutex. Two enables of one O_RDWR FIFO can
therefore both enter the callback.
fasync_helper() allocates before checking for an existing entry. If the
first enable installs both entries, a second enable can update the
reader entry and then fail the allocation for the writer entry. The
error path removes the pre-existing reader entry, clearing FASYNC while
the writer entry remains registered. __fput() then skips ->fasync(), so a
later pipe notification can dereference the freed file or its f_owner.
An unprivileged memory-pressure reproducer triggers a KASAN
slab-use-after-free in send_sigio() through this path.
Keep the reader helper's result and undo the registration only if this
call added it. The pipe mutex serializes changes to both lists, so a
failed new registration still removes its reader, while a failed
duplicate preserves the existing registrations and FASYNC. Successful
duplicate enables continue to update fa_fd as before.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/pipe.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4c42ce499ce4b1c787e61082e3b13df4f30c4eaa",
"status": "affected",
"version": "76398425bb06b07cc3a3b1ce169c67dc9d6874ed",
"versionType": "git"
},
{
"lessThan": "2259809e5b7043c4ba20af7b14ba3e471cf55521",
"status": "affected",
"version": "76398425bb06b07cc3a3b1ce169c67dc9d6874ed",
"versionType": "git"
},
{
"lessThan": "40bb03d3ea6f6a915218508819ecc4d7a7fa260d",
"status": "affected",
"version": "76398425bb06b07cc3a3b1ce169c67dc9d6874ed",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/pipe.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.30"
},
{
"lessThan": "2.6.30",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "2.6.30",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npipe: preserve existing fasync readers on writer setup failure\n\nF_SETFL and FIOASYNC decide whether to invoke -\u003efasync() before\npipe_fasync() takes pipe-\u003emutex. Two enables of one O_RDWR FIFO can\ntherefore both enter the callback.\n\nfasync_helper() allocates before checking for an existing entry. If the\nfirst enable installs both entries, a second enable can update the\nreader entry and then fail the allocation for the writer entry. The\nerror path removes the pre-existing reader entry, clearing FASYNC while\nthe writer entry remains registered. __fput() then skips -\u003efasync(), so a\nlater pipe notification can dereference the freed file or its f_owner.\nAn unprivileged memory-pressure reproducer triggers a KASAN\nslab-use-after-free in send_sigio() through this path.\n\nKeep the reader helper\u0027s result and undo the registration only if this\ncall added it. The pipe mutex serializes changes to both lists, so a\nfailed new registration still removes its reader, while a failed\nduplicate preserves the existing registrations and FASYNC. Successful\nduplicate enables continue to update fa_fd as before."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:35:57.589Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4c42ce499ce4b1c787e61082e3b13df4f30c4eaa"
},
{
"url": "https://git.kernel.org/stable/c/2259809e5b7043c4ba20af7b14ba3e471cf55521"
},
{
"url": "https://git.kernel.org/stable/c/40bb03d3ea6f6a915218508819ecc4d7a7fa260d"
}
],
"title": "pipe: preserve existing fasync readers on writer setup failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99203",
"datePublished": "2026-10-28T10:35:57.589Z",
"dateReserved": "2026-09-25T10:25:14.400Z",
"dateUpdated": "2026-10-28T10:35:57.589Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99202 (GCVE-0-2026-99202)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-28 10:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: libsas: Fix SMP IO deadlock during HA resume
smp_execute_task_sg() calls pm_runtime_get_sync() on the host before
issuing an SMP command. When that command is itself issued from the HA
resume path, the get_sync() deadlocks: it waits for the ongoing resume
(the device is RPM_RESUMING), while the resume is blocked in
sas_drain_work() waiting for that same SMP IO to complete.
The deadlock needs an expander-attached SATA disk. During
sas_resume_ha() -> sas_drain_work(), DISCE_RESUME -> sas_resume_sata()
-> ata_sas_port_resume() requests ATA_EH_RESET, and the hard reset for
such a disk is done via SMP PHY CONTROL (sas_ata_hard_reset() ->
sas_phy_reset() -> sas_smp_phy_control() ->
smp_execute_task_sg()). Direct-attached SATA resets through
lldd_control_phy() and SSP devices use TMFs, so neither hits this.
Replace the get_sync()/put_sync() pair with
pm_runtime_get_noresume()/pm_runtime_put(). smp_execute_task_sg() only
needs to hold off autosuspend while the SMP is in flight, and it must
not try to resume the host: a sync resume issued from the HA resume path
itself is what deadlocks, and by the time sas_resume_ha() runs, hw_init
has already reinitialized the hardware, so the device is accessible
without one.
The usage reference is still required. Discovery work normally runs
inside an event worker's PM reference, taken at sas_notify_port_event()
notify time and held until the handler has flushed the disco
queue. sas_rediscover_ex_phy() however requeues DISCE_REVALIDATE_DOMAIN
from within the revalidation worker itself, and flush_workqueue() does
not wait for work items queued during execution, so that chained
revalidation runs with no outer PM reference - without the
get_noresume(), its SMP could race autosuspend.
For the BSG path, sas_smp_handler() is the only caller which may find
the host autosuspended: expander SMP requests do not go through any SCSI
device request queue, so nothing else in that path holds the host
awake. Resume it there with pm_runtime_resume_and_get() and check the
result.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9e24b47ef81d43b3fb1b14294f09991640c79fcc Version: 3dbbbf656b850c9c8de05df6ad4a1dfc6ff02845 Version: 3dbbbf656b850c9c8de05df6ad4a1dfc6ff02845 Version: 09357f067122e2e28ec52e27013a1660a1571618 Version: e50a6523a603594a6d92cdecfe11997d639410a3 Version: c391b5899dd46485a5893696c12ae3e95a3a7325 Version: b9c44a14062093e9fc2d6bddc696cfceadb482d7 Version: 6.18.44 ≤ Version: 6.1.183 ≤ Version: 6.6.151 ≤ Version: 6.12.103 ≤ Version: 7.1.8 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/libsas/sas_expander.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c9fb89246d9922ac0a45d504adb03e0bb971310c",
"status": "affected",
"version": "9e24b47ef81d43b3fb1b14294f09991640c79fcc",
"versionType": "git"
},
{
"lessThan": "08b95ef36a64c3ae4490794bed3c35d0c3354e85",
"status": "affected",
"version": "3dbbbf656b850c9c8de05df6ad4a1dfc6ff02845",
"versionType": "git"
},
{
"lessThan": "81e097a064b28b4a1f6ca1a8b433e659c1bd64c0",
"status": "affected",
"version": "3dbbbf656b850c9c8de05df6ad4a1dfc6ff02845",
"versionType": "git"
},
{
"status": "affected",
"version": "09357f067122e2e28ec52e27013a1660a1571618",
"versionType": "git"
},
{
"status": "affected",
"version": "e50a6523a603594a6d92cdecfe11997d639410a3",
"versionType": "git"
},
{
"status": "affected",
"version": "c391b5899dd46485a5893696c12ae3e95a3a7325",
"versionType": "git"
},
{
"status": "affected",
"version": "b9c44a14062093e9fc2d6bddc696cfceadb482d7",
"versionType": "git"
},
{
"lessThan": "6.18.59",
"status": "affected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThan": "6.7",
"status": "affected",
"version": "6.6.151",
"versionType": "semver"
},
{
"lessThan": "6.13",
"status": "affected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThan": "7.2",
"status": "affected",
"version": "7.1.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/libsas/sas_expander.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.2"
},
{
"lessThan": "7.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "6.18.44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.183",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.151",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.12.103",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.1.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libsas: Fix SMP IO deadlock during HA resume\n\nsmp_execute_task_sg() calls pm_runtime_get_sync() on the host before\nissuing an SMP command. When that command is itself issued from the HA\nresume path, the get_sync() deadlocks: it waits for the ongoing resume\n(the device is RPM_RESUMING), while the resume is blocked in\nsas_drain_work() waiting for that same SMP IO to complete.\n\nThe deadlock needs an expander-attached SATA disk. During\nsas_resume_ha() -\u003e sas_drain_work(), DISCE_RESUME -\u003e sas_resume_sata()\n-\u003e ata_sas_port_resume() requests ATA_EH_RESET, and the hard reset for\nsuch a disk is done via SMP PHY CONTROL (sas_ata_hard_reset() -\u003e\nsas_phy_reset() -\u003e sas_smp_phy_control() -\u003e\nsmp_execute_task_sg()). Direct-attached SATA resets through\nlldd_control_phy() and SSP devices use TMFs, so neither hits this.\n\nReplace the get_sync()/put_sync() pair with\npm_runtime_get_noresume()/pm_runtime_put(). smp_execute_task_sg() only\nneeds to hold off autosuspend while the SMP is in flight, and it must\nnot try to resume the host: a sync resume issued from the HA resume path\nitself is what deadlocks, and by the time sas_resume_ha() runs, hw_init\nhas already reinitialized the hardware, so the device is accessible\nwithout one.\n\nThe usage reference is still required. Discovery work normally runs\ninside an event worker\u0027s PM reference, taken at sas_notify_port_event()\nnotify time and held until the handler has flushed the disco\nqueue. sas_rediscover_ex_phy() however requeues DISCE_REVALIDATE_DOMAIN\nfrom within the revalidation worker itself, and flush_workqueue() does\nnot wait for work items queued during execution, so that chained\nrevalidation runs with no outer PM reference - without the\nget_noresume(), its SMP could race autosuspend.\n\nFor the BSG path, sas_smp_handler() is the only caller which may find\nthe host autosuspended: expander SMP requests do not go through any SCSI\ndevice request queue, so nothing else in that path holds the host\nawake. Resume it there with pm_runtime_resume_and_get() and check the\nresult."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:35:56.827Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c9fb89246d9922ac0a45d504adb03e0bb971310c"
},
{
"url": "https://git.kernel.org/stable/c/08b95ef36a64c3ae4490794bed3c35d0c3354e85"
},
{
"url": "https://git.kernel.org/stable/c/81e097a064b28b4a1f6ca1a8b433e659c1bd64c0"
}
],
"title": "scsi: libsas: Fix SMP IO deadlock during HA resume",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99202",
"datePublished": "2026-10-28T10:35:56.827Z",
"dateReserved": "2026-09-25T10:25:14.400Z",
"dateUpdated": "2026-10-28T10:35:56.827Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99201 (GCVE-0-2026-99201)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-28 10:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netlink: avoid hashing the network namespace pointer
The netlink rhashtable key includes a raw struct net pointer and a
user-controlled port ID. Both /proc/net/netlink and socket diagnostics
expose the table's bucket order. By binding and rebinding chosen
NETLINK_USERSOCK port IDs, an unprivileged reader can distinguish equal
buckets and recover the low bits of the Jenkins hash. Its 32-bit seed
and the limited set of kernel-image slides can then be searched offline
to recover the address of init_net.
Use the namespace's unique, non-address net_cookie in the comparison
key instead. It is assigned before the per-net initializers run and
remains unchanged for the namespace's lifetime. The lookup key and
object hash are still built by netlink_compare_arg_init(), keeping
lookup, insertion, removal and rehashing consistent while preserving
namespace separation. Neither public table walker needs to change.
Reading the socket's namespace cookie in netlink_compare() is safe
under RCU, including during namespace teardown. netlink_release()
removes the socket from the hash table and defers its final put with
call_rcu(). cleanup_net() runs the per-net exit methods and waits for
outstanding RCU callbacks with rcu_barrier() before freeing namespace
storage.
Unlike ns.ns_id, net_cookie is also available and initialized during
setup_net() in older stable kernels, making the change straightforward
to backport to v5.15 and later.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netlink/af_netlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bdd55b8a8acbf6b4840ab420eb6a63774bf4593b",
"status": "affected",
"version": "c428ecd1a21f1457ca3beb4df71b8a079c410e41",
"versionType": "git"
},
{
"lessThan": "078deff25f8a849ecd1c3fe17b1e473b1cf44f28",
"status": "affected",
"version": "c428ecd1a21f1457ca3beb4df71b8a079c410e41",
"versionType": "git"
},
{
"lessThan": "f88bb3606e4bd11ee035b682cddc2999e604609a",
"status": "affected",
"version": "c428ecd1a21f1457ca3beb4df71b8a079c410e41",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netlink/af_netlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetlink: avoid hashing the network namespace pointer\n\nThe netlink rhashtable key includes a raw struct net pointer and a\nuser-controlled port ID. Both /proc/net/netlink and socket diagnostics\nexpose the table\u0027s bucket order. By binding and rebinding chosen\nNETLINK_USERSOCK port IDs, an unprivileged reader can distinguish equal\nbuckets and recover the low bits of the Jenkins hash. Its 32-bit seed\nand the limited set of kernel-image slides can then be searched offline\nto recover the address of init_net.\n\nUse the namespace\u0027s unique, non-address net_cookie in the comparison\nkey instead. It is assigned before the per-net initializers run and\nremains unchanged for the namespace\u0027s lifetime. The lookup key and\nobject hash are still built by netlink_compare_arg_init(), keeping\nlookup, insertion, removal and rehashing consistent while preserving\nnamespace separation. Neither public table walker needs to change.\n\nReading the socket\u0027s namespace cookie in netlink_compare() is safe\nunder RCU, including during namespace teardown. netlink_release()\nremoves the socket from the hash table and defers its final put with\ncall_rcu(). cleanup_net() runs the per-net exit methods and waits for\noutstanding RCU callbacks with rcu_barrier() before freeing namespace\nstorage.\n\nUnlike ns.ns_id, net_cookie is also available and initialized during\nsetup_net() in older stable kernels, making the change straightforward\nto backport to v5.15 and later."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:35:56.069Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bdd55b8a8acbf6b4840ab420eb6a63774bf4593b"
},
{
"url": "https://git.kernel.org/stable/c/078deff25f8a849ecd1c3fe17b1e473b1cf44f28"
},
{
"url": "https://git.kernel.org/stable/c/f88bb3606e4bd11ee035b682cddc2999e604609a"
}
],
"title": "netlink: avoid hashing the network namespace pointer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99201",
"datePublished": "2026-10-28T10:35:56.069Z",
"dateReserved": "2026-09-25T10:25:14.400Z",
"dateUpdated": "2026-10-28T10:35:56.069Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99200 (GCVE-0-2026-99200)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-28 10:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: hisilicon: hisi_femac: Move setting of netops to fix crash
hisi_femac_drv_probe() connects the PHY before dev->netdev_ops is
assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads
dev->netdev_ops through netdev_need_ops_lock() since the commit in
question, so probing crashes with a NULL pointer dereference when
CONFIG_NET_SHAPER is enabled.
phy_link_topo_add_phy from phy_attach_direct+0xec/0x37c
of_phy_get_and_connect from hisi_femac_drv_probe+0x1f4/0x558
Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
Assign netdev_ops before the PHY attach, as was done for emac in commit
7c9f391ec89c ("net: emac: move setting of netops to fix crash").
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/hisilicon/hisi_femac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "06ef5b084b150c538bc84148e5d710eee012413c",
"status": "affected",
"version": "ded86da4bbb78cad74cecc368fee3ae3a296e2ca",
"versionType": "git"
},
{
"lessThan": "444889dfa27b54b39026e962464b1f8f9093e1ea",
"status": "affected",
"version": "ded86da4bbb78cad74cecc368fee3ae3a296e2ca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/hisilicon/hisi_femac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.2"
},
{
"lessThan": "7.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hisilicon: hisi_femac: Move setting of netops to fix crash\n\nhisi_femac_drv_probe() connects the PHY before dev-\u003enetdev_ops is\nassigned. phy_attach_direct() -\u003e phy_link_topo_add_phy() reads\ndev-\u003enetdev_ops through netdev_need_ops_lock() since the commit in\nquestion, so probing crashes with a NULL pointer dereference when\nCONFIG_NET_SHAPER is enabled.\n\n phy_link_topo_add_phy from phy_attach_direct+0xec/0x37c\n of_phy_get_and_connect from hisi_femac_drv_probe+0x1f4/0x558\n Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b\n\nAssign netdev_ops before the PHY attach, as was done for emac in commit\n7c9f391ec89c (\"net: emac: move setting of netops to fix crash\")."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:35:55.323Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/06ef5b084b150c538bc84148e5d710eee012413c"
},
{
"url": "https://git.kernel.org/stable/c/444889dfa27b54b39026e962464b1f8f9093e1ea"
}
],
"title": "net: hisilicon: hisi_femac: Move setting of netops to fix crash",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99200",
"datePublished": "2026-10-28T10:35:55.323Z",
"dateReserved": "2026-09-25T10:25:14.400Z",
"dateUpdated": "2026-10-28T10:35:55.323Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99199 (GCVE-0-2026-99199)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-28 10:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: hisilicon: hip04_eth: Move setting of netops to fix crash
hip04_mac_probe() calls of_phy_connect() before ndev->netdev_ops is
assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads
dev->netdev_ops through netdev_need_ops_lock() since the commit in
question, so probing crashes with a NULL pointer dereference when
CONFIG_NET_SHAPER is enabled.
Assign netdev_ops before the PHY attach, as was done for emac in commit
7c9f391ec89c ("net: emac: move setting of netops to fix crash").
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/hisilicon/hip04_eth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1c2f9c3a63baabfb965a23a00f026f3ddcaadb24",
"status": "affected",
"version": "ded86da4bbb78cad74cecc368fee3ae3a296e2ca",
"versionType": "git"
},
{
"lessThan": "0d9342701f14ec0a9465772b7cd5d515c1ecd818",
"status": "affected",
"version": "ded86da4bbb78cad74cecc368fee3ae3a296e2ca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/hisilicon/hip04_eth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.2"
},
{
"lessThan": "7.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hisilicon: hip04_eth: Move setting of netops to fix crash\n\nhip04_mac_probe() calls of_phy_connect() before ndev-\u003enetdev_ops is\nassigned. phy_attach_direct() -\u003e phy_link_topo_add_phy() reads\ndev-\u003enetdev_ops through netdev_need_ops_lock() since the commit in\nquestion, so probing crashes with a NULL pointer dereference when\nCONFIG_NET_SHAPER is enabled.\n\nAssign netdev_ops before the PHY attach, as was done for emac in commit\n7c9f391ec89c (\"net: emac: move setting of netops to fix crash\")."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:35:54.538Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1c2f9c3a63baabfb965a23a00f026f3ddcaadb24"
},
{
"url": "https://git.kernel.org/stable/c/0d9342701f14ec0a9465772b7cd5d515c1ecd818"
}
],
"title": "net: hisilicon: hip04_eth: Move setting of netops to fix crash",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99199",
"datePublished": "2026-10-28T10:35:54.538Z",
"dateReserved": "2026-09-25T10:25:14.400Z",
"dateUpdated": "2026-10-28T10:35:54.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99198 (GCVE-0-2026-99198)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-28 10:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: actions: Move setting of netops to fix crash
owl_emac_probe() calls owl_emac_phy_init(), which connects the PHY,
before netdev->netdev_ops is assigned. phy_attach_direct() ->
phy_link_topo_add_phy() reads dev->netdev_ops through
netdev_need_ops_lock() since the commit in question, so probing crashes
with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.
Assign netdev_ops before the PHY attach, as was done for emac in commit
7c9f391ec89c ("net: emac: move setting of netops to fix crash").
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/actions/owl-emac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d2eca3a54f415081711cd102d0db733de5abf170",
"status": "affected",
"version": "ded86da4bbb78cad74cecc368fee3ae3a296e2ca",
"versionType": "git"
},
{
"lessThan": "c2c4824319850c87e77d26aeb8f860bc310a64d7",
"status": "affected",
"version": "ded86da4bbb78cad74cecc368fee3ae3a296e2ca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/actions/owl-emac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.2"
},
{
"lessThan": "7.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: actions: Move setting of netops to fix crash\n\nowl_emac_probe() calls owl_emac_phy_init(), which connects the PHY,\nbefore netdev-\u003enetdev_ops is assigned. phy_attach_direct() -\u003e\nphy_link_topo_add_phy() reads dev-\u003enetdev_ops through\nnetdev_need_ops_lock() since the commit in question, so probing crashes\nwith a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.\n\nAssign netdev_ops before the PHY attach, as was done for emac in commit\n7c9f391ec89c (\"net: emac: move setting of netops to fix crash\")."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:35:53.740Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d2eca3a54f415081711cd102d0db733de5abf170"
},
{
"url": "https://git.kernel.org/stable/c/c2c4824319850c87e77d26aeb8f860bc310a64d7"
}
],
"title": "net: ethernet: actions: Move setting of netops to fix crash",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99198",
"datePublished": "2026-10-28T10:35:53.740Z",
"dateReserved": "2026-09-25T10:25:14.400Z",
"dateUpdated": "2026-10-28T10:35:53.740Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99197 (GCVE-0-2026-99197)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-28 10:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: mv643xx: move setting of netops to fix crash
mv643xx_eth_probe() connects the PHY before dev->netdev_ops is
assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads
dev->netdev_ops through netdev_need_ops_lock() since the commit in
question, so probing crashes with a NULL pointer dereference when
CONFIG_NET_SHAPER is enabled.
Assign netdev_ops before the PHY attach, as was done for emac in commit
7c9f391ec89c ("net: emac: move setting of netops to fix crash").
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/marvell/mv643xx_eth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bfb1ca89e9f6efa26c8a4a5b9de46541a222abc9",
"status": "affected",
"version": "ded86da4bbb78cad74cecc368fee3ae3a296e2ca",
"versionType": "git"
},
{
"lessThan": "a3eef3d2cca032d8768b5eb07aab0f46b79bfd8a",
"status": "affected",
"version": "ded86da4bbb78cad74cecc368fee3ae3a296e2ca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/marvell/mv643xx_eth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.2"
},
{
"lessThan": "7.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mv643xx: move setting of netops to fix crash\n\nmv643xx_eth_probe() connects the PHY before dev-\u003enetdev_ops is\nassigned. phy_attach_direct() -\u003e phy_link_topo_add_phy() reads\ndev-\u003enetdev_ops through netdev_need_ops_lock() since the commit in\nquestion, so probing crashes with a NULL pointer dereference when\nCONFIG_NET_SHAPER is enabled.\n\nAssign netdev_ops before the PHY attach, as was done for emac in commit\n7c9f391ec89c (\"net: emac: move setting of netops to fix crash\")."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:35:52.987Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bfb1ca89e9f6efa26c8a4a5b9de46541a222abc9"
},
{
"url": "https://git.kernel.org/stable/c/a3eef3d2cca032d8768b5eb07aab0f46b79bfd8a"
}
],
"title": "net: mv643xx: move setting of netops to fix crash",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99197",
"datePublished": "2026-10-28T10:35:52.987Z",
"dateReserved": "2026-09-25T10:25:14.400Z",
"dateUpdated": "2026-10-28T10:35:52.987Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99196 (GCVE-0-2026-99196)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-28 10:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: au1000: move setting of netops to fix crash
au1000_probe() calls au1000_mii_probe(), which connects the PHY,
before dev->netdev_ops is assigned. phy_attach_direct() ->
phy_link_topo_add_phy() reads dev->netdev_ops through
netdev_need_ops_lock() since the commit in question, so probing crashes
with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.
Assign netdev_ops before the PHY attach, as was done for emac in commit
7c9f391ec89c ("net: emac: move setting of netops to fix crash").
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/amd/au1000_eth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cfc11024fc061bf36044b40de9ecab57ed0a537d",
"status": "affected",
"version": "ded86da4bbb78cad74cecc368fee3ae3a296e2ca",
"versionType": "git"
},
{
"lessThan": "beabbafdd0f6779813a7656baa1b412b19bda911",
"status": "affected",
"version": "ded86da4bbb78cad74cecc368fee3ae3a296e2ca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/amd/au1000_eth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.2"
},
{
"lessThan": "7.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: au1000: move setting of netops to fix crash\n\nau1000_probe() calls au1000_mii_probe(), which connects the PHY,\nbefore dev-\u003enetdev_ops is assigned. phy_attach_direct() -\u003e\nphy_link_topo_add_phy() reads dev-\u003enetdev_ops through\nnetdev_need_ops_lock() since the commit in question, so probing crashes\nwith a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.\n\nAssign netdev_ops before the PHY attach, as was done for emac in commit\n7c9f391ec89c (\"net: emac: move setting of netops to fix crash\")."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:35:52.223Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cfc11024fc061bf36044b40de9ecab57ed0a537d"
},
{
"url": "https://git.kernel.org/stable/c/beabbafdd0f6779813a7656baa1b412b19bda911"
}
],
"title": "net: au1000: move setting of netops to fix crash",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99196",
"datePublished": "2026-10-28T10:35:52.223Z",
"dateReserved": "2026-09-25T10:25:14.400Z",
"dateUpdated": "2026-10-28T10:35:52.223Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99195 (GCVE-0-2026-99195)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-28 10:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: ethoc: move setting of netops to fix crash
ethoc_probe() calls ethoc_mdio_probe(), which connects the PHY,
before netdev->netdev_ops is assigned. phy_attach_direct() ->
phy_link_topo_add_phy() reads dev->netdev_ops through
netdev_need_ops_lock() since the commit in question, so probing crashes
with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.
Assign netdev_ops before the PHY attach, as was done for emac in commit
7c9f391ec89c ("net: emac: move setting of netops to fix crash").
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/ethoc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c51b13299b4d45226efb09e532fb33e7109f78d7",
"status": "affected",
"version": "ded86da4bbb78cad74cecc368fee3ae3a296e2ca",
"versionType": "git"
},
{
"lessThan": "c9f8ce62a5faa73515ff5457716bd7306d20fd93",
"status": "affected",
"version": "ded86da4bbb78cad74cecc368fee3ae3a296e2ca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/ethoc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.2"
},
{
"lessThan": "7.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethoc: move setting of netops to fix crash\n\nethoc_probe() calls ethoc_mdio_probe(), which connects the PHY,\nbefore netdev-\u003enetdev_ops is assigned. phy_attach_direct() -\u003e\nphy_link_topo_add_phy() reads dev-\u003enetdev_ops through\nnetdev_need_ops_lock() since the commit in question, so probing crashes\nwith a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.\n\nAssign netdev_ops before the PHY attach, as was done for emac in commit\n7c9f391ec89c (\"net: emac: move setting of netops to fix crash\")."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:35:51.485Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c51b13299b4d45226efb09e532fb33e7109f78d7"
},
{
"url": "https://git.kernel.org/stable/c/c9f8ce62a5faa73515ff5457716bd7306d20fd93"
}
],
"title": "net: ethoc: move setting of netops to fix crash",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99195",
"datePublished": "2026-10-28T10:35:51.485Z",
"dateReserved": "2026-09-25T10:25:14.400Z",
"dateUpdated": "2026-10-28T10:35:51.485Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99194 (GCVE-0-2026-99194)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-28 10:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: aeroflex: move setting of netops to fix crash
greth_of_probe() calls greth_mdio_init(), which connects the PHY,
before dev->netdev_ops is assigned. phy_attach_direct() ->
phy_link_topo_add_phy() reads dev->netdev_ops through
netdev_need_ops_lock() since the commit in question, so probing crashes
with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.
Assign netdev_ops before the PHY attach, as was done for emac in commit
7c9f391ec89c ("net: emac: move setting of netops to fix crash").
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/aeroflex/greth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5293e376e9d6cdb945db11f71821bb57d415631d",
"status": "affected",
"version": "ded86da4bbb78cad74cecc368fee3ae3a296e2ca",
"versionType": "git"
},
{
"lessThan": "d71483f0716e7ae98578817bfdc8a5b822d250f8",
"status": "affected",
"version": "ded86da4bbb78cad74cecc368fee3ae3a296e2ca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/aeroflex/greth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.2"
},
{
"lessThan": "7.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: aeroflex: move setting of netops to fix crash\n\ngreth_of_probe() calls greth_mdio_init(), which connects the PHY,\nbefore dev-\u003enetdev_ops is assigned. phy_attach_direct() -\u003e\nphy_link_topo_add_phy() reads dev-\u003enetdev_ops through\nnetdev_need_ops_lock() since the commit in question, so probing crashes\nwith a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.\n\nAssign netdev_ops before the PHY attach, as was done for emac in commit\n7c9f391ec89c (\"net: emac: move setting of netops to fix crash\")."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:35:50.670Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5293e376e9d6cdb945db11f71821bb57d415631d"
},
{
"url": "https://git.kernel.org/stable/c/d71483f0716e7ae98578817bfdc8a5b822d250f8"
}
],
"title": "net: ethernet: aeroflex: move setting of netops to fix crash",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99194",
"datePublished": "2026-10-28T10:35:50.670Z",
"dateReserved": "2026-09-25T10:25:14.400Z",
"dateUpdated": "2026-10-28T10:35:50.670Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99193 (GCVE-0-2026-99193)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-28 10:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: ti: icssm-prueth: Move setting of netops to fix crash
icssm_prueth_netdev_init() calls of_phy_get_and_connect() before
ndev->netdev_ops is assigned. phy_attach_direct() ->
phy_link_topo_add_phy() reads dev->netdev_ops through
netdev_need_ops_lock() since the commit in question, so probing crashes
with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.
Assign netdev_ops before the PHY attach, as was done for emac in commit
7c9f391ec89c ("net: emac: move setting of netops to fix crash").
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/ti/icssm/icssm_prueth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e7694aab7ad002480ed9d534bd8d6bc28b798d8a",
"status": "affected",
"version": "ded86da4bbb78cad74cecc368fee3ae3a296e2ca",
"versionType": "git"
},
{
"lessThan": "955bb7cf680d8699ce94c73539af882840a9be43",
"status": "affected",
"version": "ded86da4bbb78cad74cecc368fee3ae3a296e2ca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/ti/icssm/icssm_prueth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.2"
},
{
"lessThan": "7.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ti: icssm-prueth: Move setting of netops to fix crash\n\nicssm_prueth_netdev_init() calls of_phy_get_and_connect() before\nndev-\u003enetdev_ops is assigned. phy_attach_direct() -\u003e\nphy_link_topo_add_phy() reads dev-\u003enetdev_ops through\nnetdev_need_ops_lock() since the commit in question, so probing crashes\nwith a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.\n\nAssign netdev_ops before the PHY attach, as was done for emac in commit\n7c9f391ec89c (\"net: emac: move setting of netops to fix crash\")."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:35:49.441Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e7694aab7ad002480ed9d534bd8d6bc28b798d8a"
},
{
"url": "https://git.kernel.org/stable/c/955bb7cf680d8699ce94c73539af882840a9be43"
}
],
"title": "net: ti: icssm-prueth: Move setting of netops to fix crash",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99193",
"datePublished": "2026-10-28T10:35:49.441Z",
"dateReserved": "2026-09-25T10:25:14.400Z",
"dateUpdated": "2026-10-28T10:35:49.441Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99192 (GCVE-0-2026-99192)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-28 10:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: bcmgenet: unshare the skb before writing the control block
bcmgenet stores first_cb, last_cb and bytes_sent in the skb control
block and reads them back on completion to free the skb and credit BQL.
ether_setup() leaves IFF_TX_SKB_SHARING set, so the stack can resubmit
a shared skb that is still in the ring. The next transmit overwrites
last_cb, so the earlier slots complete without crediting their bytes
and BQL stalls the queue until the watchdog resets it.
Unshare the skb before writing the control block.
Reproduce with pktgen in clone_skb mode, which hands the driver the same
skb while earlier copies are still in the ring:
modprobe pktgen
pg=/proc/net/pktgen
echo "add_device eth0" > $pg/kpktgend_0
echo "dst_mac AA:BB:CC:DD:EE:FF" > $pg/eth0
echo "dst 192.0.2.1" > $pg/eth0
echo "clone_skb 8" > $pg/eth0
echo "count 0" > $pg/eth0
echo start > $pg/pgctrl &
sleep 5
echo stop > $pg/pgctrl
wait
cat /sys/class/net/eth0/queues/tx-0/byte_queue_limits/inflight
inflight stays nonzero on the now idle queue. clone_skb 0 leaves it at
zero.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/genet/bcmgenet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "40c04abcbc34e3afe338f41dae851ecbd72852ac",
"status": "affected",
"version": "f48bed16a756f5bc0244acd581f61968f7d7c2a4",
"versionType": "git"
},
{
"lessThan": "7939ad3b4db9eadf45a64f0524f38337a9494672",
"status": "affected",
"version": "f48bed16a756f5bc0244acd581f61968f7d7c2a4",
"versionType": "git"
},
{
"lessThan": "89771ce4f8f67dcffae561b2ccac95c0f6e3aa01",
"status": "affected",
"version": "f48bed16a756f5bc0244acd581f61968f7d7c2a4",
"versionType": "git"
},
{
"status": "affected",
"version": "fb4ca2b4bc6712a6ad635df5b9b41131846589f9",
"versionType": "git"
},
{
"lessThan": "3.17",
"status": "affected",
"version": "3.16.50",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/genet/bcmgenet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.13"
},
{
"lessThan": "4.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.16.50",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmgenet: unshare the skb before writing the control block\n\nbcmgenet stores first_cb, last_cb and bytes_sent in the skb control\nblock and reads them back on completion to free the skb and credit BQL.\nether_setup() leaves IFF_TX_SKB_SHARING set, so the stack can resubmit\na shared skb that is still in the ring. The next transmit overwrites\nlast_cb, so the earlier slots complete without crediting their bytes\nand BQL stalls the queue until the watchdog resets it.\n\nUnshare the skb before writing the control block.\n\nReproduce with pktgen in clone_skb mode, which hands the driver the same\nskb while earlier copies are still in the ring:\n\n modprobe pktgen\n pg=/proc/net/pktgen\n echo \"add_device eth0\" \u003e $pg/kpktgend_0\n echo \"dst_mac AA:BB:CC:DD:EE:FF\" \u003e $pg/eth0\n echo \"dst 192.0.2.1\" \u003e $pg/eth0\n echo \"clone_skb 8\" \u003e $pg/eth0\n echo \"count 0\" \u003e $pg/eth0\n echo start \u003e $pg/pgctrl \u0026\n sleep 5\n echo stop \u003e $pg/pgctrl\n wait\n cat /sys/class/net/eth0/queues/tx-0/byte_queue_limits/inflight\n\ninflight stays nonzero on the now idle queue. clone_skb 0 leaves it at\nzero."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:35:48.686Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/40c04abcbc34e3afe338f41dae851ecbd72852ac"
},
{
"url": "https://git.kernel.org/stable/c/7939ad3b4db9eadf45a64f0524f38337a9494672"
},
{
"url": "https://git.kernel.org/stable/c/89771ce4f8f67dcffae561b2ccac95c0f6e3aa01"
}
],
"title": "net: bcmgenet: unshare the skb before writing the control block",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99192",
"datePublished": "2026-10-28T10:35:48.686Z",
"dateReserved": "2026-09-25T10:25:14.400Z",
"dateUpdated": "2026-10-28T10:35:48.686Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99191 (GCVE-0-2026-99191)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-28 10:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()
calipso_skbuff_setattr() adjusts payload_len by the length of the
option it inserts or resizes:
payload = ntohs(ip6_hdr->payload_len);
ip6_hdr->payload_len = htons(payload + len_delta);
GRO can build BIG TCP packets larger than IPV6_MAXPLEN, and stores
payload_len == 0 for them; ipv6_payload_len() then falls back to
skb->len. For such a packet forwarded to a destination mapped to
CALIPSO, the code above writes len_delta (or 65536 + len_delta when
shrinking) into payload_len, and ipv6_payload_len() no longer falls
back to skb->len. nf_tables, conntrack and sch_cake rely on it.
The same arithmetic also wraps when a packet grows past IPV6_MAXPLEN,
and a BIG TCP packet that shrinks below IPV6_MAXPLEN should get its
real length back.
Set payload_len from the skb length with ipv6_set_payload_len(), which
stores 0 above IPV6_MAXPLEN and the real length otherwise, as
ipv6_gro_complete() does. The network header was just reset to
skb->data, so skb->len - sizeof(*ip6_hdr) is the payload length.
Tested on one kernel (arm64, QEMU) with SELinux permissive, a minimal
mdp-generated policy (network_peer_controls=1), "netlabelctl calipso
add pass doi:16" and a NetLabel mapping of fd00:2::/64 to CALIPSO
DOI 16. calipso_skbuff_setattr() was called through
netlbl_skbuff_setattr() from a test-only debugfs hook (not part of
this patch) adding a level-only label; payload_len after the call:
case before fix after fix real length
1000, unlabeled 1016 1016 1016
70000 GSO, payload_len 0 16 0 70016
65530 GSO, grows past MAXPLEN 10 0 65546
65540 GSO with a 24 byte hop
header, shrinks below MAXPLEN 65528 65532 65532
1000 with a 24 byte hop header 992 992 992
(0 means ipv6_payload_len() returns the real length.) On the forward
path, with a client injecting unlabeled UDP through a router to a
server, the router adds the CALIPSO option and the server delivers all
datagrams (Udp6InDatagrams 5, Ip6InTruncatedPkts 0) with this patch.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/calipso.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1c9fcfca51e3c5cd46dd72a4da74d56eff183513",
"status": "affected",
"version": "81fbc812132cbc72a0f933b19bfd3a829bd946e4",
"versionType": "git"
},
{
"lessThan": "8ee0e03663826a76507048d58466b29321a57656",
"status": "affected",
"version": "81fbc812132cbc72a0f933b19bfd3a829bd946e4",
"versionType": "git"
},
{
"lessThan": "8070ed578b6b9134e045627fb745c887a806d46e",
"status": "affected",
"version": "81fbc812132cbc72a0f933b19bfd3a829bd946e4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/calipso.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncalipso: keep BIG TCP payload_len in calipso_skbuff_setattr()\n\ncalipso_skbuff_setattr() adjusts payload_len by the length of the\noption it inserts or resizes:\n\n\tpayload = ntohs(ip6_hdr-\u003epayload_len);\n\tip6_hdr-\u003epayload_len = htons(payload + len_delta);\n\nGRO can build BIG TCP packets larger than IPV6_MAXPLEN, and stores\npayload_len == 0 for them; ipv6_payload_len() then falls back to\nskb-\u003elen. For such a packet forwarded to a destination mapped to\nCALIPSO, the code above writes len_delta (or 65536 + len_delta when\nshrinking) into payload_len, and ipv6_payload_len() no longer falls\nback to skb-\u003elen. nf_tables, conntrack and sch_cake rely on it.\n\nThe same arithmetic also wraps when a packet grows past IPV6_MAXPLEN,\nand a BIG TCP packet that shrinks below IPV6_MAXPLEN should get its\nreal length back.\n\nSet payload_len from the skb length with ipv6_set_payload_len(), which\nstores 0 above IPV6_MAXPLEN and the real length otherwise, as\nipv6_gro_complete() does. The network header was just reset to\nskb-\u003edata, so skb-\u003elen - sizeof(*ip6_hdr) is the payload length.\n\nTested on one kernel (arm64, QEMU) with SELinux permissive, a minimal\nmdp-generated policy (network_peer_controls=1), \"netlabelctl calipso\nadd pass doi:16\" and a NetLabel mapping of fd00:2::/64 to CALIPSO\nDOI 16. calipso_skbuff_setattr() was called through\nnetlbl_skbuff_setattr() from a test-only debugfs hook (not part of\nthis patch) adding a level-only label; payload_len after the call:\n\n case before fix after fix real length\n 1000, unlabeled 1016 1016 1016\n 70000 GSO, payload_len 0 16 0 70016\n 65530 GSO, grows past MAXPLEN 10 0 65546\n 65540 GSO with a 24 byte hop\n header, shrinks below MAXPLEN 65528 65532 65532\n 1000 with a 24 byte hop header 992 992 992\n\n(0 means ipv6_payload_len() returns the real length.) On the forward\npath, with a client injecting unlabeled UDP through a router to a\nserver, the router adds the CALIPSO option and the server delivers all\ndatagrams (Udp6InDatagrams 5, Ip6InTruncatedPkts 0) with this patch."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:35:47.854Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1c9fcfca51e3c5cd46dd72a4da74d56eff183513"
},
{
"url": "https://git.kernel.org/stable/c/8ee0e03663826a76507048d58466b29321a57656"
},
{
"url": "https://git.kernel.org/stable/c/8070ed578b6b9134e045627fb745c887a806d46e"
}
],
"title": "calipso: keep BIG TCP payload_len in calipso_skbuff_setattr()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99191",
"datePublished": "2026-10-28T10:35:47.854Z",
"dateReserved": "2026-09-25T10:25:14.400Z",
"dateUpdated": "2026-10-28T10:35:47.854Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99190 (GCVE-0-2026-99190)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-28 10:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths
A drive-by review by Sashiko reports that, after a failed call to
gpiochip_set_multiple(), gpiod_set_array_value() returns abruptly,
bypassing the freeing of possibly alloced bitmaps, potentially leaking
memory. It is an unlikely error path, but is possible.
Defer the return code check until after the bitmap_free() block.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpiolib.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "78189c0e35abbcdab3b8ab0b764d578c02900734",
"status": "affected",
"version": "9b407312755fd5db012413ca005f0f3a661db8dd",
"versionType": "git"
},
{
"lessThan": "890c3bf08e0fc09eff788a6cfeded7d21b4d3e9d",
"status": "affected",
"version": "9b407312755fd5db012413ca005f0f3a661db8dd",
"versionType": "git"
},
{
"lessThan": "c28846ca1ac6134881114d272314623c8433e372",
"status": "affected",
"version": "9b407312755fd5db012413ca005f0f3a661db8dd",
"versionType": "git"
},
{
"status": "affected",
"version": "d73d2a569e6212f58d89efc6e66ffbb2386a47b1",
"versionType": "git"
},
{
"lessThan": "6.13",
"status": "affected",
"version": "6.12.114",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpiolib.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.12.114",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths\n\nA drive-by review by Sashiko reports that, after a failed call to\ngpiochip_set_multiple(), gpiod_set_array_value() returns abruptly,\nbypassing the freeing of possibly alloced bitmaps, potentially leaking\nmemory. It is an unlikely error path, but is possible.\n\nDefer the return code check until after the bitmap_free() block."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:35:47.107Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/78189c0e35abbcdab3b8ab0b764d578c02900734"
},
{
"url": "https://git.kernel.org/stable/c/890c3bf08e0fc09eff788a6cfeded7d21b4d3e9d"
},
{
"url": "https://git.kernel.org/stable/c/c28846ca1ac6134881114d272314623c8433e372"
}
],
"title": "gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99190",
"datePublished": "2026-10-28T10:35:47.107Z",
"dateReserved": "2026-09-25T10:25:14.400Z",
"dateUpdated": "2026-10-28T10:35:47.107Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99189 (GCVE-0-2026-99189)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-28 10:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
gpio: mxc: fix race between chained IRQ handler install and probe completion
mxc_update_irq_chained_handler() is called before the IRQ domain, the
generic IRQ chip, and the port list entry are set up. If an interrupt
arrives in that window:
- mx3_gpio_irq_handler() calls generic_handle_domain_irq() with
port->domain still NULL.
- mx2_gpio_irq_handler() walks mxc_gpio_ports, but the port has not
been added to the list yet.
Additionally, if any of the subsequent probe steps
(gpio_generic_chip_init(), devm_gpiochip_add_data(),
irq_domain_create_legacy(), or mxc_gpio_init_gc()) fail, the error
paths never unregister the chained handler, leaving a dangling handler
that points at freed memory.
Move the handler installation after all its dependencies are ready and
after list_add_tail(), so the handler is never live while the data
structures it touches are incomplete, and is never installed if probe
fails.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-mxc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "261802c14e1a3281987ea8f106701e5ed9652f68",
"status": "affected",
"version": "5f6d1998adeb5374ef248b5ba2e2a0c30ab0f60b",
"versionType": "git"
},
{
"lessThan": "6c1e035d881579a6e4ed1ce5feabb13d23e80a82",
"status": "affected",
"version": "5f6d1998adeb5374ef248b5ba2e2a0c30ab0f60b",
"versionType": "git"
},
{
"lessThan": "38d44f78f041ffe60c8e2443b99434a199e7541d",
"status": "affected",
"version": "5f6d1998adeb5374ef248b5ba2e2a0c30ab0f60b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-mxc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: mxc: fix race between chained IRQ handler install and probe completion\n\nmxc_update_irq_chained_handler() is called before the IRQ domain, the\ngeneric IRQ chip, and the port list entry are set up. If an interrupt\narrives in that window:\n\n - mx3_gpio_irq_handler() calls generic_handle_domain_irq() with\n port-\u003edomain still NULL.\n - mx2_gpio_irq_handler() walks mxc_gpio_ports, but the port has not\n been added to the list yet.\n\nAdditionally, if any of the subsequent probe steps\n(gpio_generic_chip_init(), devm_gpiochip_add_data(),\nirq_domain_create_legacy(), or mxc_gpio_init_gc()) fail, the error\npaths never unregister the chained handler, leaving a dangling handler\nthat points at freed memory.\n\nMove the handler installation after all its dependencies are ready and\nafter list_add_tail(), so the handler is never live while the data\nstructures it touches are incomplete, and is never installed if probe\nfails."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:35:46.366Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/261802c14e1a3281987ea8f106701e5ed9652f68"
},
{
"url": "https://git.kernel.org/stable/c/6c1e035d881579a6e4ed1ce5feabb13d23e80a82"
},
{
"url": "https://git.kernel.org/stable/c/38d44f78f041ffe60c8e2443b99434a199e7541d"
}
],
"title": "gpio: mxc: fix race between chained IRQ handler install and probe completion",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99189",
"datePublished": "2026-10-28T10:35:46.366Z",
"dateReserved": "2026-09-25T10:25:14.400Z",
"dateUpdated": "2026-10-28T10:35:46.366Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99188 (GCVE-0-2026-99188)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-28 10:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: stmmac: dwmac1000: clear the RGMII status interrupt
Since commit 2e2c878a3141 ("net: stmmac: remove SGMII/RGMII/SMII
interrupt handling") nothing on the RGMII path reads GMAC_RGSMIIIS, so
RGSMIIIS stays pending behind GMAC_INT_MASK from the first link change
on. stmmac_resume() resets the MAC in stmmac_hw_setup(); the reset sets
GMAC_INT_MASK to 0 until dwmac1000_core_init() writes the mask again,
and the pending status storms the line:
dwmac_dma_interrupt: unexpected status 04000000
A register dump at the first message on ODROID-HC4 showed it:
core int_status 00000001 int_mask 00000000 pmt 00000000 rgsmiiis 0000000d
When the resume thread runs on the CPU that takes the MAC interrupt,
the storm starves it: a soft lockup, then a watchdog reset or a hang.
Read GMAC_RGSMIIIS in dwmac1000_irq_status() when the status is not
masked, as the driver did before 2e2c878a3141; the read clears it.
Wake-on-LAN resume from s2idle with the resume thread and the MAC
interrupt on one CPU: Helios64 (dwmac-rk), 7.3-rc6, soft-locked in 3 of
3 resumes without a fix and in 0 of 10 with this patch; it ran with an
out-of-tree dwmac-rk change that keeps the GMAC powered across suspend.
ODROID-HC4 (dwmac-meson8b): 0 of 10 with this patch, 2 of 2 without a
fix on a 7.3-rc5 build. irq_rgmii_n went up by one per resume.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "affc6d572935282ef9ab1e0b790cbc31e5ad8bca",
"status": "affected",
"version": "2e2c878a314175a4c3b76ee3be455f543438f472",
"versionType": "git"
},
{
"lessThan": "aa07285705f8d5bac464eb1c5b7412f8e88b91e1",
"status": "affected",
"version": "2e2c878a314175a4c3b76ee3be455f543438f472",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"lessThan": "6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: dwmac1000: clear the RGMII status interrupt\n\nSince commit 2e2c878a3141 (\"net: stmmac: remove SGMII/RGMII/SMII\ninterrupt handling\") nothing on the RGMII path reads GMAC_RGSMIIIS, so\nRGSMIIIS stays pending behind GMAC_INT_MASK from the first link change\non. stmmac_resume() resets the MAC in stmmac_hw_setup(); the reset sets\nGMAC_INT_MASK to 0 until dwmac1000_core_init() writes the mask again,\nand the pending status storms the line:\n\n dwmac_dma_interrupt: unexpected status 04000000\n\nA register dump at the first message on ODROID-HC4 showed it:\n\n core int_status 00000001 int_mask 00000000 pmt 00000000 rgsmiiis 0000000d\n\nWhen the resume thread runs on the CPU that takes the MAC interrupt,\nthe storm starves it: a soft lockup, then a watchdog reset or a hang.\n\nRead GMAC_RGSMIIIS in dwmac1000_irq_status() when the status is not\nmasked, as the driver did before 2e2c878a3141; the read clears it.\n\nWake-on-LAN resume from s2idle with the resume thread and the MAC\ninterrupt on one CPU: Helios64 (dwmac-rk), 7.3-rc6, soft-locked in 3 of\n3 resumes without a fix and in 0 of 10 with this patch; it ran with an\nout-of-tree dwmac-rk change that keeps the GMAC powered across suspend.\nODROID-HC4 (dwmac-meson8b): 0 of 10 with this patch, 2 of 2 without a\nfix on a 7.3-rc5 build. irq_rgmii_n went up by one per resume."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:35:45.591Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/affc6d572935282ef9ab1e0b790cbc31e5ad8bca"
},
{
"url": "https://git.kernel.org/stable/c/aa07285705f8d5bac464eb1c5b7412f8e88b91e1"
}
],
"title": "net: stmmac: dwmac1000: clear the RGMII status interrupt",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99188",
"datePublished": "2026-10-28T10:35:45.591Z",
"dateReserved": "2026-09-25T10:25:14.400Z",
"dateUpdated": "2026-10-28T10:35:45.591Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-99187 (GCVE-0-2026-99187)
Vulnerability from cvelistv5
Published
2026-10-28 10:35
Modified
2026-10-28 10:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
perf: Fix perf_pmu_migrate_context() leaving events behind
__perf_pmu_remove() walks the group leaders of a CPU and PMU with
perf_event_groups_for_cpu_pmu(), removing each one as it goes.
perf_remove_from_context() takes the leader out of the groups rbtree,
after which rb_next() on that node returns NULL, prematurely ending the
walk. Other groups stay behind in the source context.
On CPU hotplug, they are then torn down with the dying CPU. They keep
running until teardown, while the PMU's interrupt and migrated events
are on a new CPU, which drivers rely on never happening.
Walk ctx->event_list instead and pick out the PMU's events by their
pmu_ctx.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/events/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3eb08f09bfb364051f51316da873c3bd51a839ef",
"status": "affected",
"version": "bd27568117664b8b3e259721393df420ed51f57b",
"versionType": "git"
},
{
"lessThan": "f5f0028764de322a3d04eda0d3b6389ca9847446",
"status": "affected",
"version": "bd27568117664b8b3e259721393df420ed51f57b",
"versionType": "git"
},
{
"lessThan": "e76b36b4be7160eaa14b416681e548b125702395",
"status": "affected",
"version": "bd27568117664b8b3e259721393df420ed51f57b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/events/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.59",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.59",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.13",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix perf_pmu_migrate_context() leaving events behind\n\n__perf_pmu_remove() walks the group leaders of a CPU and PMU with\nperf_event_groups_for_cpu_pmu(), removing each one as it goes.\nperf_remove_from_context() takes the leader out of the groups rbtree,\nafter which rb_next() on that node returns NULL, prematurely ending the\nwalk. Other groups stay behind in the source context.\n\nOn CPU hotplug, they are then torn down with the dying CPU. They keep\nrunning until teardown, while the PMU\u0027s interrupt and migrated events\nare on a new CPU, which drivers rely on never happening.\n\nWalk ctx-\u003eevent_list instead and pick out the PMU\u0027s events by their\npmu_ctx."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T10:35:44.813Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3eb08f09bfb364051f51316da873c3bd51a839ef"
},
{
"url": "https://git.kernel.org/stable/c/f5f0028764de322a3d04eda0d3b6389ca9847446"
},
{
"url": "https://git.kernel.org/stable/c/e76b36b4be7160eaa14b416681e548b125702395"
}
],
"title": "perf: Fix perf_pmu_migrate_context() leaving events behind",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99187",
"datePublished": "2026-10-28T10:35:44.813Z",
"dateReserved": "2026-09-25T10:25:14.400Z",
"dateUpdated": "2026-10-28T10:35:44.813Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}