{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:40:45.930Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/mm/pat/memtype.c",
            "include/linux/pgtable.h",
            "kernel/fork.c",
            "mm/memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a6623712ba8449876f0b3de9462831523fb851e4",
              "status": "affected",
              "version": "2ab640379a0ab4cef746ced1d7e04a0941774bcb",
              "versionType": "git"
            },
            {
              "lessThan": "b07398e8a5da517083f5c3f2daa8f6681b48ab28",
              "status": "affected",
              "version": "2ab640379a0ab4cef746ced1d7e04a0941774bcb",
              "versionType": "git"
            },
            {
              "lessThan": "8d6373f83f367dbed316ddeb178130a3a64b5b67",
              "status": "affected",
              "version": "2ab640379a0ab4cef746ced1d7e04a0941774bcb",
              "versionType": "git"
            },
            {
              "lessThan": "da381c33f3aa6406406c9fdf07b8b0b63e0ce722",
              "status": "affected",
              "version": "2ab640379a0ab4cef746ced1d7e04a0941774bcb",
              "versionType": "git"
            },
            {
              "lessThan": "de6185b8892d88142ef69768fe4077cbf40109c0",
              "status": "affected",
              "version": "2ab640379a0ab4cef746ced1d7e04a0941774bcb",
              "versionType": "git"
            },
            {
              "lessThan": "dc84bc2aba85a1508f04a936f9f9a15f64ebfb31",
              "status": "affected",
              "version": "2ab640379a0ab4cef746ced1d7e04a0941774bcb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/mm/pat/memtype.c",
            "include/linux/pgtable.h",
            "kernel/fork.c",
            "mm/memory.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.29"
            },
            {
              "lessThan": "2.6.29",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.160",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.87",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.23",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()\n\nIf track_pfn_copy() fails, we already added the dst VMA to the maple\ntree. As fork() fails, we\u0027ll cleanup the maple tree, and stumble over\nthe dst VMA for which we neither performed any reservation nor copied\nany page tables.\n\nConsequently untrack_pfn() will see VM_PAT and try obtaining the\nPAT information from the page table -- which fails because the page\ntable was not copied.\n\nThe easiest fix would be to simply clear the VM_PAT flag of the dst VMA\nif track_pfn_copy() fails. However, the whole thing is about \"simply\"\nclearing the VM_PAT flag is shaky as well: if we passed track_pfn_copy()\nand performed a reservation, but copying the page tables fails, we\u0027ll\nsimply clear the VM_PAT flag, not properly undoing the reservation ...\nwhich is also wrong.\n\nSo let\u0027s fix it properly: set the VM_PAT flag only if the reservation\nsucceeded (leaving it clear initially), and undo the reservation if\nanything goes wrong while copying the page tables: clearing the VM_PAT\nflag after undoing the reservation.\n\nNote that any copied page table entries will get zapped when the VMA will\nget removed later, after copy_page_range() succeeded; as VM_PAT is not set\nthen, we won\u0027t try cleaning VM_PAT up once more and untrack_pfn() will be\nhappy. Note that leaving these page tables in place without a reservation\nis not a problem, as we are aborting fork(); this process will never run.\n\nA reproducer can trigger this usually at the first try:\n\n  https://gitlab.com/davidhildenbrand/scratchspace/-/raw/main/reproducers/pat_fork.c\n\n  WARNING: CPU: 26 PID: 11650 at arch/x86/mm/pat/memtype.c:983 get_pat_info+0xf6/0x110\n  Modules linked in: ...\n  CPU: 26 UID: 0 PID: 11650 Comm: repro3 Not tainted 6.12.0-rc5+ #92\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014\n  RIP: 0010:get_pat_info+0xf6/0x110\n  ...\n  Call Trace:\n   \u003cTASK\u003e\n   ...\n   untrack_pfn+0x52/0x110\n   unmap_single_vma+0xa6/0xe0\n   unmap_vmas+0x105/0x1f0\n   exit_mmap+0xf6/0x460\n   __mmput+0x4b/0x120\n   copy_process+0x1bf6/0x2aa0\n   kernel_clone+0xab/0x440\n   __do_sys_clone+0x66/0x90\n   do_syscall_64+0x95/0x180\n\nLikely this case was missed in:\n\n  d155df53f310 (\"x86/mm/pat: clear VM_PAT if copy_p4d_range failed\")\n\n... and instead of undoing the reservation we simply cleared the VM_PAT flag.\n\nKeep the documentation of these functions in include/linux/pgtable.h,\none place is more than sufficient -- we should clean that up for the other\nfunctions like track_pfn_remap/untrack_pfn separately."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is triggered entirely through local syscalls \u2014 mmap() of a device node that creates a whole-VMA VM_PFNMAP/VM_PAT mapping followed by fork()/clone(). No network or remote peer data is involved.\nAC:L - Deterministic trigger paths exist with no race or attacker-uncontrollable state: track_pfn_copy() unconditionally returns -EINVAL for a COW VM_PAT mapping whose first page has been COWed, and get_pat_info() unconditionally WARNs for a shared VM_PAT mapping whose PTEs were zapped (vfio BAR reset, TTM eviction, fbdev VT switch); the maintainer notes a reproducer triggers \"usually at the first try\".\nPR:L - Only an unprivileged local user account is needed, provided it can mmap any device that uses whole-VMA remap_pfn_range()/vm_iomap_memory() \u2014 DRM render nodes, /dev/kfd, /dev/fb0, UIO and vfio-pci, all routinely granted to normal users, Android apps, or DPDK operator accounts. No capability check guards copy_page_range() or the PAT tracking path.\nUI:N - The attacking process performs the mmap, the write fault and the fork() itself; no action by any other user or victim process is required.\nS:U - The corruption is confined to kernel PAT bookkeeping and the attacking process\u0027s own address-space teardown; no VM, IOMMU or sandbox boundary is crossed.\nC:L - The WARN_ON_ONCE splat dumps kernel register state, RIP and a call trace (defeating KASLR for readers of the log), and destroying a live PAT reservation allows the same physical range to be re-mapped with an incompatible cache mode, exposing stale/incoherent data. There is no arbitrary kernel-memory read primitive.\nI:H - untrack_pfn() on the dst VMA frees a memtype reservation that still belongs to the live parent mapping, and the subsequent END_MATCH erase can silently truncate an unrelated memtype entry \u2014 destroying the kernel\u0027s only protection against conflicting cacheability aliases, which x86 defines as undefined behaviour causing CPU cache/data corruption.\nA:H - The bug produces a kernel WARNING/oops in get_pat_info() (an outright panic on the common panic_on_warn=1 hardening setting), and the sibling path permanently leaks a memtype reservation, blocking later remapping of that physical range and leaking kernel memory."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:56:44.221Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a6623712ba8449876f0b3de9462831523fb851e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/b07398e8a5da517083f5c3f2daa8f6681b48ab28"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d6373f83f367dbed316ddeb178130a3a64b5b67"
        },
        {
          "url": "https://git.kernel.org/stable/c/da381c33f3aa6406406c9fdf07b8b0b63e0ce722"
        },
        {
          "url": "https://git.kernel.org/stable/c/de6185b8892d88142ef69768fe4077cbf40109c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc84bc2aba85a1508f04a936f9f9a15f64ebfb31"
        }
      ],
      "title": "x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22090",
    "datePublished": "2025-04-16T14:12:42.561Z",
    "dateReserved": "2024-12-29T08:45:45.817Z",
    "dateUpdated": "2026-08-05T11:56:44.221Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:39:48.711Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/composite.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dba96dfa5a0f685b959dd28a52ac8dab0b805204",
              "status": "affected",
              "version": "37a3a533429ef9b3cc9f15a656c19623f0e88df7",
              "versionType": "git"
            },
            {
              "lessThan": "2db29235e900a084a656dea7e0939b0abb7bb897",
              "status": "affected",
              "version": "37a3a533429ef9b3cc9f15a656c19623f0e88df7",
              "versionType": "git"
            },
            {
              "lessThan": "8afb22aa063f706f3343707cdfb8cda4d021dd33",
              "status": "affected",
              "version": "37a3a533429ef9b3cc9f15a656c19623f0e88df7",
              "versionType": "git"
            },
            {
              "lessThan": "e624bf26127645a2f7821e73fdf6dc64bad07835",
              "status": "affected",
              "version": "37a3a533429ef9b3cc9f15a656c19623f0e88df7",
              "versionType": "git"
            },
            {
              "lessThan": "aada327a9f8028c573636fa60c0abc80fb8135c9",
              "status": "affected",
              "version": "37a3a533429ef9b3cc9f15a656c19623f0e88df7",
              "versionType": "git"
            },
            {
              "lessThan": "5f06ee9f9a3665d43133f125c17e5258a13f3963",
              "status": "affected",
              "version": "37a3a533429ef9b3cc9f15a656c19623f0e88df7",
              "versionType": "git"
            },
            {
              "lessThan": "bd3c4ef60baf7f65c963f3e12d9d7b2b091e20ba",
              "status": "affected",
              "version": "37a3a533429ef9b3cc9f15a656c19623f0e88df7",
              "versionType": "git"
            },
            {
              "lessThan": "e1be1f380c82a69f80c68c96a7cfe8759fb30355",
              "status": "affected",
              "version": "37a3a533429ef9b3cc9f15a656c19623f0e88df7",
              "versionType": "git"
            },
            {
              "lessThan": "151c0aa896c47a4459e07fee7d4843f44c1bb18e",
              "status": "affected",
              "version": "37a3a533429ef9b3cc9f15a656c19623f0e88df7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/composite.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.16"
            },
            {
              "lessThan": "3.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.148",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.102",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget : fix use-after-free in composite_dev_cleanup()\n\n1. In func configfs_composite_bind() -\u003e composite_os_desc_req_prepare():\nif kmalloc fails, the pointer cdev-\u003eos_desc_req will be freed but not\nset to NULL. Then it will return a failure to the upper-level function.\n2. in func configfs_composite_bind() -\u003e composite_dev_cleanup():\nit will checks whether cdev-\u003eos_desc_req is NULL. If it is not NULL, it\nwill attempt to use it.This will lead to a use-after-free issue.\n\nBUG: KASAN: use-after-free in composite_dev_cleanup+0xf4/0x2c0\nRead of size 8 at addr 0000004827837a00 by task init/1\n\nCPU: 10 PID: 1 Comm: init Tainted: G           O      5.10.97-oh #1\n kasan_report+0x188/0x1cc\n __asan_load8+0xb4/0xbc\n composite_dev_cleanup+0xf4/0x2c0\n configfs_composite_bind+0x210/0x7ac\n udc_bind_to_driver+0xb4/0x1ec\n usb_gadget_probe_driver+0xec/0x21c\n gadget_dev_desc_UDC_store+0x264/0x27c"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached entirely from local userspace by writing to the gadget\u0027s configfs `UDC` attribute (`gadget_dev_desc_UDC_store()` \u2192 `udc_bind_to_driver()` \u2192 `configfs_composite_bind()`); no USB bus traffic, attached host, or physical device access participates in triggering it. Despite being in the USB gadget stack, the trigger is a plain local file write, so Local is both accurate and higher severity than Physical.\nAC:L - Once the 4 KB `kmalloc()` returns NULL the dangling `cdev-\u003eos_desc_req` is dereferenced deterministically on the unwind path with no race to win, and the attacker controls every other precondition (`os_desc` group enabled to set `use_os_string`, unlimited retries of the `UDC` write) while driving the system toward the allocation failure with ordinary memory pressure. The long `purge_configs_funcs()` window between free and use also lets the attacker reliably spray the freed slab object rather than depending on unknowable layout.\nPR:L - configfs is not mountable from a user namespace, but the `/sys/kernel/config/usb_gadget` tree is commonly delegated to a non-root service account (Android\u0027s system-uid USB gadget HAL, embedded gadget managers), so an unprivileged-but-delegated local account can create the `os_desc` configuration and write `UDC`. No capability check guards the store handler itself beyond file ownership.\nUI:N - The attacker performs the whole sequence \u2014 building the gadget, enabling OS descriptors, generating memory pressure, and writing `UDC` \u2014 with no action required from any other user or administrator. The use-after-free fires inside the attacker\u0027s own write syscall.\nS:U - The corruption occurs in kernel slab memory during the calling task\u0027s own syscall and stays within the kernel\u0027s security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `composite_dev_cleanup()` reads `cdev-\u003eos_desc_req-\u003ebuf` out of a freed slab object after a long reclaim window, and an attacker who sprays that object controls the value used for a subsequent `kfree()`, turning the UAF into a heap-manipulation primitive that can be leveraged to read arbitrary kernel memory. Per kernel scoring guidance, a use-after-free is High confidentiality impact.\nI:H - The stale pointer yields `kfree()` of an attacker-influenced pointer plus a NULL write into the reclaimed object and then a second free of the already-freed `usb_request` \u2014 an arbitrary-free and double-free combination that is a well-established route to slab corruption, arbitrary write, and control-flow hijack.\nA:H - Even without exploitation the double free and freeing of a bogus `buf` pointer corrupt the SLUB freelist and reliably produce a KASAN report, BUG, or kernel panic \u2014 the reporter\u0027s own trace shows the oops occurring in PID 1 (`init`), which is fatal to the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:02:53.142Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dba96dfa5a0f685b959dd28a52ac8dab0b805204"
        },
        {
          "url": "https://git.kernel.org/stable/c/2db29235e900a084a656dea7e0939b0abb7bb897"
        },
        {
          "url": "https://git.kernel.org/stable/c/8afb22aa063f706f3343707cdfb8cda4d021dd33"
        },
        {
          "url": "https://git.kernel.org/stable/c/e624bf26127645a2f7821e73fdf6dc64bad07835"
        },
        {
          "url": "https://git.kernel.org/stable/c/aada327a9f8028c573636fa60c0abc80fb8135c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f06ee9f9a3665d43133f125c17e5258a13f3963"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd3c4ef60baf7f65c963f3e12d9d7b2b091e20ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1be1f380c82a69f80c68c96a7cfe8759fb30355"
        },
        {
          "url": "https://git.kernel.org/stable/c/151c0aa896c47a4459e07fee7d4843f44c1bb18e"
        }
      ],
      "title": "usb: gadget : fix use-after-free in composite_dev_cleanup()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38555",
    "datePublished": "2025-08-19T17:02:34.110Z",
    "dateReserved": "2025-04-16T04:51:24.025Z",
    "dateUpdated": "2026-08-05T12:02:53.142Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:42:48.789Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-39730",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:41:59.038817Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:18.274Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/export.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7f8eca87fef7519e9c41f3258f25ebc2752247ee",
              "status": "affected",
              "version": "20fa19027286983ab2734b5910c4a687436e0c31",
              "versionType": "git"
            },
            {
              "lessThan": "cb09afa0948d96b1e385d609ed044bb1aa043536",
              "status": "affected",
              "version": "20fa19027286983ab2734b5910c4a687436e0c31",
              "versionType": "git"
            },
            {
              "lessThan": "3570ef5c31314c13274c935a20b91768ab5bf412",
              "status": "affected",
              "version": "20fa19027286983ab2734b5910c4a687436e0c31",
              "versionType": "git"
            },
            {
              "lessThan": "763810bb883cb4de412a72f338d80947d97df67b",
              "status": "affected",
              "version": "20fa19027286983ab2734b5910c4a687436e0c31",
              "versionType": "git"
            },
            {
              "lessThan": "12ad3def2e5e0b120e3d0cb6ce8b7b796819ad40",
              "status": "affected",
              "version": "20fa19027286983ab2734b5910c4a687436e0c31",
              "versionType": "git"
            },
            {
              "lessThan": "2ad40b7992aa26bc631afc1a995b0e3ddc30de3f",
              "status": "affected",
              "version": "20fa19027286983ab2734b5910c4a687436e0c31",
              "versionType": "git"
            },
            {
              "lessThan": "b7f7866932466332a2528fda099000b035303485",
              "status": "affected",
              "version": "20fa19027286983ab2734b5910c4a687436e0c31",
              "versionType": "git"
            },
            {
              "lessThan": "7dd36f7477d1e03a1fcf8d13531ca326c4fb599f",
              "status": "affected",
              "version": "20fa19027286983ab2734b5910c4a687436e0c31",
              "versionType": "git"
            },
            {
              "lessThan": "ef93a685e01a281b5e2a25ce4e3428cf9371a205",
              "status": "affected",
              "version": "20fa19027286983ab2734b5910c4a687436e0c31",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/export.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.148",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.102",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix filehandle bounds checking in nfs_fh_to_dentry()\n\nThe function needs to check the minimal filehandle length before it can\naccess the embedded filehandle."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:35:09.757Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7f8eca87fef7519e9c41f3258f25ebc2752247ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb09afa0948d96b1e385d609ed044bb1aa043536"
        },
        {
          "url": "https://git.kernel.org/stable/c/3570ef5c31314c13274c935a20b91768ab5bf412"
        },
        {
          "url": "https://git.kernel.org/stable/c/763810bb883cb4de412a72f338d80947d97df67b"
        },
        {
          "url": "https://git.kernel.org/stable/c/12ad3def2e5e0b120e3d0cb6ce8b7b796819ad40"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ad40b7992aa26bc631afc1a995b0e3ddc30de3f"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7f7866932466332a2528fda099000b035303485"
        },
        {
          "url": "https://git.kernel.org/stable/c/7dd36f7477d1e03a1fcf8d13531ca326c4fb599f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef93a685e01a281b5e2a25ce4e3428cf9371a205"
        }
      ],
      "title": "NFS: Fix filehandle bounds checking in nfs_fh_to_dentry()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39730",
    "datePublished": "2025-09-07T15:16:19.377Z",
    "dateReserved": "2025-04-16T07:20:57.118Z",
    "dateUpdated": "2026-06-11T18:44:18.274Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:40:19.561Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e64732ebff9e24258e7326f07adbe2f2b990daf8",
              "status": "affected",
              "version": "c1db52b9d27ee6e15a7136e67e4a21dc916cd07f",
              "versionType": "git"
            },
            {
              "lessThan": "789415771422f4fb9f444044f86ecfaec55df1bd",
              "status": "affected",
              "version": "c1db52b9d27ee6e15a7136e67e4a21dc916cd07f",
              "versionType": "git"
            },
            {
              "lessThan": "c73c773b09e313278f9b960303a2809b8440bac6",
              "status": "affected",
              "version": "c1db52b9d27ee6e15a7136e67e4a21dc916cd07f",
              "versionType": "git"
            },
            {
              "lessThan": "8c767727f331fb9455b0f81daad832b5925688cb",
              "status": "affected",
              "version": "c1db52b9d27ee6e15a7136e67e4a21dc916cd07f",
              "versionType": "git"
            },
            {
              "lessThan": "14ca6952691fa8cc91e7644512e6ff24a595283f",
              "status": "affected",
              "version": "c1db52b9d27ee6e15a7136e67e4a21dc916cd07f",
              "versionType": "git"
            },
            {
              "lessThan": "7858a95566f4ebf59524666683d2dcdba3fca968",
              "status": "affected",
              "version": "c1db52b9d27ee6e15a7136e67e4a21dc916cd07f",
              "versionType": "git"
            },
            {
              "lessThan": "c51a45ad9070a6d296174fcbe5c466352836c12b",
              "status": "affected",
              "version": "c1db52b9d27ee6e15a7136e67e4a21dc916cd07f",
              "versionType": "git"
            },
            {
              "lessThan": "81cfe34d0630de4e23ae804dcc08fb6f861dc37d",
              "status": "affected",
              "version": "c1db52b9d27ee6e15a7136e67e4a21dc916cd07f",
              "versionType": "git"
            },
            {
              "lessThan": "16d8fd74dbfca0ea58645cd2fca13be10cae3cdd",
              "status": "affected",
              "version": "c1db52b9d27ee6e15a7136e67e4a21dc916cd07f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.29"
            },
            {
              "lessThan": "2.6.29",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.148",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.102",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtl818x: Kill URBs before clearing tx status queue\n\nIn rtl8187_stop() move the call of usb_kill_anchored_urbs() before clearing\nb_tx_status.queue. This change prevents callbacks from using already freed\nskb due to anchor was not killed before freeing such skb.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000080\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: Oops: 0000 [#1] SMP NOPTI\n CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Not tainted 6.15.0 #8 PREEMPT(voluntary)\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015\n RIP: 0010:ieee80211_tx_status_irqsafe+0x21/0xc0 [mac80211]\n Call Trace:\n  \u003cIRQ\u003e\n  rtl8187_tx_cb+0x116/0x150 [rtl8187]\n  __usb_hcd_giveback_urb+0x9d/0x120\n  usb_giveback_urb_bh+0xbb/0x140\n  process_one_work+0x19b/0x3c0\n  bh_worker+0x1a7/0x210\n  tasklet_action+0x10/0x30\n  handle_softirqs+0xf0/0x340\n  __irq_exit_rcu+0xcd/0xf0\n  common_interrupt+0x85/0xa0\n  \u003c/IRQ\u003e\n\nTested on RTL8187BvE device.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is armed by locally bringing the wireless interface down (`ip link set wlan0 down` \u2192 `ieee80211_stop()` \u2192 `ieee80211_do_stop()` \u2192 `drv_stop()` \u2192 `rtl8187_stop()`) while local TX traffic keeps URBs in flight; no received 802.11 frame or routable packet can invoke the driver\u0027s stop callback, so an adjacent or remote peer cannot reach the vulnerable path.\nAC:L - The attacker owns both sides of the race \u2014 they flood the TX path to keep more than five entries in `b_tx_status.queue` (the exact precondition for the racing `skb_dequeue()` in `rtl8187_tx_cb()`\u0027s drain loop) and then issue the interface-down, repeating the up/down cycle indefinitely until the window between the drain loop and `usb_kill_anchored_urbs()` is hit; `CONFIG_RTL8187` is a stock distro module, so no rare configuration is required.\nPR:L - Bringing the interface down requires CAP_NET_ADMIN over the network namespace owning the netdev, which an unprivileged user holds via `unshare -Ur` once the wiphy has been delegated into a container netns \u2014 the same reasoning applied to mac80211 configuration paths in CVE-2025-38642; on desktop deployments polkit additionally lets an active unprivileged session toggle WiFi through NetworkManager.\nUI:N - The attacker performs both the traffic generation and the interface down/up cycle themselves; no victim needs to open a file, mount anything, or take any other action.\nS:U - The freed/NULL sk_buff is dereferenced in the host kernel\u0027s own driver and mac80211 context, with no VM, IOMMU, or sandbox boundary crossed.\nC:H - The fix exists to stop URB completion callbacks from consuming skbs already released by `dev_kfree_skb_any()`; a freed `struct sk_buff` reallocated by a concurrent attacker-controlled allocation supplies the `ieee80211_hw *` read from `info-\u003erate_driver_data[0]` and is then relinked into mac80211\u0027s status queues, yielding a controlled kernel-pointer dereference and read primitive.\nI:H - The same use-after-free window lets a sprayed replacement object drive `hw-\u003epriv` and the subsequent `ieee80211_tx_status_irqsafe()` queueing, and skbs re-queued by `rtl8187_tx_cb()` after the drain are later freed again, giving double-free and heap-corruption primitives exploitable for control-flow hijack.\nA:H - The reproduced impact on real RTL8187BvE hardware is a kernel oops from `ieee80211_tx_status_irqsafe()` dereferencing a NULL skb inside the USB giveback BH, which kills the softirq worker and wedges the WLAN device, and becomes a full panic on systems with `panic_on_oops`; the attacker can re-trigger it at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:03:25.920Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e64732ebff9e24258e7326f07adbe2f2b990daf8"
        },
        {
          "url": "https://git.kernel.org/stable/c/789415771422f4fb9f444044f86ecfaec55df1bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/c73c773b09e313278f9b960303a2809b8440bac6"
        },
        {
          "url": "https://git.kernel.org/stable/c/8c767727f331fb9455b0f81daad832b5925688cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/14ca6952691fa8cc91e7644512e6ff24a595283f"
        },
        {
          "url": "https://git.kernel.org/stable/c/7858a95566f4ebf59524666683d2dcdba3fca968"
        },
        {
          "url": "https://git.kernel.org/stable/c/c51a45ad9070a6d296174fcbe5c466352836c12b"
        },
        {
          "url": "https://git.kernel.org/stable/c/81cfe34d0630de4e23ae804dcc08fb6f861dc37d"
        },
        {
          "url": "https://git.kernel.org/stable/c/16d8fd74dbfca0ea58645cd2fca13be10cae3cdd"
        }
      ],
      "title": "wifi: rtl818x: Kill URBs before clearing tx status queue",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38604",
    "datePublished": "2025-08-19T17:03:43.358Z",
    "dateReserved": "2025-04-16T04:51:24.028Z",
    "dateUpdated": "2026-08-05T12:03:25.920Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:40:45.643Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/f2fs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dc0172c74bd9edaee7bea2ebb35f3dbd37a8ae80",
              "status": "affected",
              "version": "3c62be17d4f562f43fe1d03b48194399caa35aa5",
              "versionType": "git"
            },
            {
              "lessThan": "1cf1ff15f262e8baf12201b270b6a79f9d119b2d",
              "status": "affected",
              "version": "3c62be17d4f562f43fe1d03b48194399caa35aa5",
              "versionType": "git"
            },
            {
              "lessThan": "666b7cf6ac9aa074b8319a2b68cba7f2c30023f0",
              "status": "affected",
              "version": "3c62be17d4f562f43fe1d03b48194399caa35aa5",
              "versionType": "git"
            },
            {
              "lessThan": "3466721f06edff834f99d9f49f23eabc6b2cb78e",
              "status": "affected",
              "version": "3c62be17d4f562f43fe1d03b48194399caa35aa5",
              "versionType": "git"
            },
            {
              "lessThan": "345fc8d1838f3f8be7c8ed08d86a13dedef67136",
              "status": "affected",
              "version": "3c62be17d4f562f43fe1d03b48194399caa35aa5",
              "versionType": "git"
            },
            {
              "lessThan": "70849d33130a2cf1d6010069ed200669c8651fbd",
              "status": "affected",
              "version": "3c62be17d4f562f43fe1d03b48194399caa35aa5",
              "versionType": "git"
            },
            {
              "lessThan": "755427093e4294ac111c3f9e40d53f681a0fbdaa",
              "status": "affected",
              "version": "3c62be17d4f562f43fe1d03b48194399caa35aa5",
              "versionType": "git"
            },
            {
              "lessThan": "1b1efa5f0e878745e94a98022e8edc675a87d78e",
              "status": "affected",
              "version": "3c62be17d4f562f43fe1d03b48194399caa35aa5",
              "versionType": "git"
            },
            {
              "lessThan": "5661998536af52848cc4d52a377e90368196edea",
              "status": "affected",
              "version": "3c62be17d4f562f43fe1d03b48194399caa35aa5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/f2fs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.10"
            },
            {
              "lessThan": "4.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.148",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.102",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid out-of-boundary access in devs.path\n\n- touch /mnt/f2fs/012345678901234567890123456789012345678901234567890123\n- truncate -s $((1024*1024*1024)) \\\n  /mnt/f2fs/012345678901234567890123456789012345678901234567890123\n- touch /mnt/f2fs/file\n- truncate -s $((1024*1024*1024)) /mnt/f2fs/file\n- mkfs.f2fs /mnt/f2fs/012345678901234567890123456789012345678901234567890123 \\\n  -c /mnt/f2fs/file\n- mount /mnt/f2fs/012345678901234567890123456789012345678901234567890123 \\\n  /mnt/f2fs/loop\n\n[16937.192225] F2FS-fs (loop0): Mount Device [ 0]: /mnt/f2fs/012345678901234567890123456789012345678901234567890123\\xff\\x01,      511,        0 -    3ffff\n[16937.192268] F2FS-fs (loop0): Failed to find devices\n\nIf device path length equals to MAX_PATH_LEN, sbi-\u003edevs.path[] may\nnot end up w/ null character due to path array is fully filled, So\naccidently, fields locate after path[] may be treated as part of\ndevice path, result in parsing wrong device path.\n\nstruct f2fs_dev_info {\n...\n\tchar path[MAX_PATH_LEN];\n...\n};\n\nLet\u0027s add one byte space for sbi-\u003edevs.path[] to store null\ncharacter of device path string."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The only trigger is `mount(2)` of a crafted f2fs image whose superblock `devs[].path` is a full 64 bytes with no terminator (`get_tree_bdev` \u2192 `f2fs_fill_super` \u2192 `f2fs_scan_devices`), and the resulting disclosure is read back locally via `/proc/fs/f2fs/\u003cdev\u003e/disk_map`. No network or peer-supplied data reaches this code; between Physical (removable media) and Local, the higher-severity Local applies.\nAC:L - The attacker fully controls the on-disk `f2fs_device.path[64]` bytes and the adjacent `total_segments` value, so filling the path completely deterministically leaves `sbi-\u003edevs[i].path` unterminated on every mount \u2014 exactly as the reporter demonstrated. There is no race, no memory-layout guessing, and the trailing struct fields (`start_blk`/`end_blk`) are deterministically derived from segment counts the attacker chooses.\nPR:N - The attacker needs no account or privileges on the victim system \u2014 only delivery of a malicious f2fs image on an SD card, USB stick, or disk image that a privileged auto-mount daemon (Android vold, udisks2) or administrator later processes, which is the most severe reasonable scenario for f2fs given its role as the standard Android/removable-media filesystem.\nUI:R - f2fs does not set `FS_USERNS_MOUNT`, so mounting requires `CAP_SYS_ADMIN` in the initial user namespace; the crafted image therefore reaches the vulnerable code only when a victim inserts the media or mounts the image, and that mount action constitutes user interaction.\nS:U - The over-read, the leaked slab contents, and any resulting fault all remain within the kernel\u0027s own security authority on the host performing the mount; no VM, container, or IOMMU boundary is crossed.\nC:H - The unterminated string is read until an arbitrary in-memory NUL, so the length is determined by heap contents rather than by any bound: the over-read spills into `total_segments`/`start_blk`/`end_blk`, into `nr_blkz` and the `blkz_seq` kernel heap pointer on zoned devices, and past the end of the `kzalloc`\u0027d `f2fs_dev_info` array at its last element. Those bytes are printed verbatim into dmesg and exported through the world-readable 0444 `/proc/fs/f2fs/\u003cdev\u003e/disk_map`, so adjacent slab data and a kernel heap pointer (defeating KASLR) are disclosed to unprivileged userspace and can be re-read at will.\nI:L - The mis-parsed string is handed to `bdev_file_open_by_path()`, so f2fs can attach to and write filesystem data onto a block device whose path exceeds the 64-byte on-disk field \u2014 a target the format otherwise cannot name \u2014 corrupting that device\u0027s contents. There is no out-of-bounds write or attacker-controlled store, so the modification is limited rather than arbitrary.\nA:H - The strlen/vsnprintf walk past the end of the slab object faults hard on hardened configurations (KFENCE guard page, `panic_on_warn` with a KASAN slab-out-of-bounds report) and can read into unmapped memory at a slab-page boundary, oopsing the mounting task. Even without a fault, the mis-parsed device path aborts the mount with \"Failed to find devices\", leaving the volume \u2014 typically the device\u0027s primary Android/SD-card storage \u2014 unusable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:03:40.653Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dc0172c74bd9edaee7bea2ebb35f3dbd37a8ae80"
        },
        {
          "url": "https://git.kernel.org/stable/c/1cf1ff15f262e8baf12201b270b6a79f9d119b2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/666b7cf6ac9aa074b8319a2b68cba7f2c30023f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/3466721f06edff834f99d9f49f23eabc6b2cb78e"
        },
        {
          "url": "https://git.kernel.org/stable/c/345fc8d1838f3f8be7c8ed08d86a13dedef67136"
        },
        {
          "url": "https://git.kernel.org/stable/c/70849d33130a2cf1d6010069ed200669c8651fbd"
        },
        {
          "url": "https://git.kernel.org/stable/c/755427093e4294ac111c3f9e40d53f681a0fbdaa"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b1efa5f0e878745e94a98022e8edc675a87d78e"
        },
        {
          "url": "https://git.kernel.org/stable/c/5661998536af52848cc4d52a377e90368196edea"
        }
      ],
      "title": "f2fs: fix to avoid out-of-boundary access in devs.path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38652",
    "datePublished": "2025-08-22T16:00:56.445Z",
    "dateReserved": "2025-04-16T04:51:24.030Z",
    "dateUpdated": "2026-08-05T12:03:40.653Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:42:08.973Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/device.c",
            "drivers/infiniband/core/sysfs.c",
            "include/rdma/ib_verbs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9a5b7f8842a90a5e6eeff37f9f6d814e61ea3529",
              "status": "affected",
              "version": "467f432a521a284c418e3d521ee51840a5e23424",
              "versionType": "git"
            },
            {
              "lessThan": "d5212b99649c5740154f307e9e3d7fee9bf62773",
              "status": "affected",
              "version": "467f432a521a284c418e3d521ee51840a5e23424",
              "versionType": "git"
            },
            {
              "lessThan": "0cf80f924aecb5b2bebd4f4ad11b2efc676a0b78",
              "status": "affected",
              "version": "467f432a521a284c418e3d521ee51840a5e23424",
              "versionType": "git"
            },
            {
              "lessThan": "df45ae2a4f1cdfda00c032839e12092e1f32c05e",
              "status": "affected",
              "version": "467f432a521a284c418e3d521ee51840a5e23424",
              "versionType": "git"
            },
            {
              "lessThan": "c14d9704f5d77a7c7fa46e2114b64a4f75b64e17",
              "status": "affected",
              "version": "467f432a521a284c418e3d521ee51840a5e23424",
              "versionType": "git"
            },
            {
              "lessThan": "6682da5d8fd578a5068531d01633c9d2e4c8f12b",
              "status": "affected",
              "version": "467f432a521a284c418e3d521ee51840a5e23424",
              "versionType": "git"
            },
            {
              "lessThan": "a1ecb30f90856b0be4168ad51b8875148e285c1f",
              "status": "affected",
              "version": "467f432a521a284c418e3d521ee51840a5e23424",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/device.c",
            "drivers/infiniband/core/sysfs.c",
            "include/rdma/ib_verbs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.180",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.180",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.134",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.87",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.23",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Don\u0027t expose hw_counters outside of init net namespace\n\nCommit 467f432a521a (\"RDMA/core: Split port and device counter sysfs\nattributes\") accidentally almost exposed hw counters to non-init net\nnamespaces. It didn\u0027t expose them fully, as an attempt to read any of\nthose counters leads to a crash like this one:\n\n[42021.807566] BUG: kernel NULL pointer dereference, address: 0000000000000028\n[42021.814463] #PF: supervisor read access in kernel mode\n[42021.819549] #PF: error_code(0x0000) - not-present page\n[42021.824636] PGD 0 P4D 0\n[42021.827145] Oops: 0000 [#1] SMP PTI\n[42021.830598] CPU: 82 PID: 2843922 Comm: switchto-defaul Kdump: loaded Tainted: G S      W I        XXX\n[42021.841697] Hardware name: XXX\n[42021.849619] RIP: 0010:hw_stat_device_show+0x1e/0x40 [ib_core]\n[42021.855362] Code: 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 49 89 d0 4c 8b 5e 20 48 8b 8f b8 04 00 00 48 81 c7 f0 fa ff ff \u003c48\u003e 8b 41 28 48 29 ce 48 83 c6 d0 48 c1 ee 04 69 d6 ab aa aa aa 48\n[42021.873931] RSP: 0018:ffff97fe90f03da0 EFLAGS: 00010287\n[42021.879108] RAX: ffff9406988a8c60 RBX: ffff940e1072d438 RCX: 0000000000000000\n[42021.886169] RDX: ffff94085f1aa000 RSI: ffff93c6cbbdbcb0 RDI: ffff940c7517aef0\n[42021.893230] RBP: ffff97fe90f03e70 R08: ffff94085f1aa000 R09: 0000000000000000\n[42021.900294] R10: ffff94085f1aa000 R11: ffffffffc0775680 R12: ffffffff87ca2530\n[42021.907355] R13: ffff940651602840 R14: ffff93c6cbbdbcb0 R15: ffff94085f1aa000\n[42021.914418] FS:  00007fda1a3b9700(0000) GS:ffff94453fb80000(0000) knlGS:0000000000000000\n[42021.922423] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[42021.928130] CR2: 0000000000000028 CR3: 00000042dcfb8003 CR4: 00000000003726f0\n[42021.935194] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[42021.942257] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[42021.949324] Call Trace:\n[42021.951756]  \u003cTASK\u003e\n[42021.953842]  [\u003cffffffff86c58674\u003e] ? show_regs+0x64/0x70\n[42021.959030]  [\u003cffffffff86c58468\u003e] ? __die+0x78/0xc0\n[42021.963874]  [\u003cffffffff86c9ef75\u003e] ? page_fault_oops+0x2b5/0x3b0\n[42021.969749]  [\u003cffffffff87674b92\u003e] ? exc_page_fault+0x1a2/0x3c0\n[42021.975549]  [\u003cffffffff87801326\u003e] ? asm_exc_page_fault+0x26/0x30\n[42021.981517]  [\u003cffffffffc0775680\u003e] ? __pfx_show_hw_stats+0x10/0x10 [ib_core]\n[42021.988482]  [\u003cffffffffc077564e\u003e] ? hw_stat_device_show+0x1e/0x40 [ib_core]\n[42021.995438]  [\u003cffffffff86ac7f8e\u003e] dev_attr_show+0x1e/0x50\n[42022.000803]  [\u003cffffffff86a3eeb1\u003e] sysfs_kf_seq_show+0x81/0xe0\n[42022.006508]  [\u003cffffffff86a11134\u003e] seq_read_iter+0xf4/0x410\n[42022.011954]  [\u003cffffffff869f4b2e\u003e] vfs_read+0x16e/0x2f0\n[42022.017058]  [\u003cffffffff869f50ee\u003e] ksys_read+0x6e/0xe0\n[42022.022073]  [\u003cffffffff8766f1ca\u003e] do_syscall_64+0x6a/0xa0\n[42022.027441]  [\u003cffffffff8780013b\u003e] entry_SYSCALL_64_after_hwframe+0x78/0xe2\n\nThe problem can be reproduced using the following steps:\n  ip netns add foo\n  ip netns exec foo bash\n  cat /sys/class/infiniband/mlx4_0/hw_counters/*\n\nThe panic occurs because of casting the device pointer into an\nib_device pointer using container_of() in hw_stat_device_show() is\nwrong and leads to a memory corruption.\n\nHowever the real problem is that hw counters should never been exposed\noutside of the non-init net namespace.\n\nFix this by saving the index of the corresponding attribute group\n(it might be 1 or 2 depending on the presence of driver-specific\nattributes) and zeroing the pointer to hw_counters group for compat\ndevices during the initialization.\n\nWith this fix applied hw_counters are not available in a non-init\nnet namespace:\n  find /sys/class/infiniband/mlx4_0/ -name hw_counters\n    /sys/class/infiniband/mlx4_0/ports/1/hw_counters\n    /sys/class/infiniband/mlx4_0/ports/2/hw_counters\n    /sys/class/infiniband/mlx4_0/hw_counters\n\n  ip netns add foo\n  ip netns exec foo bash\n  find /sys/class/infiniband/mlx4_0/ -name hw_counters"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is triggered by a local `read()`/`write()` syscall on a sysfs attribute under `/sys/class/infiniband/\u003cdev\u003e/hw_counters/`, after the attacker places itself in a non-initial network namespace. No network input reaches the vulnerable code.\nAC:L - The trigger is fully deterministic and requires no race: create a netns, mount sysfs, read the counter file (the commit message documents the exact three-command reproducer). `ib_devices_shared_netns` defaults to true, so no unusual configuration is needed.\nPR:L - An unprivileged local user can reach it via `unshare -Urnm` plus a sysfs mount, since sysfs is `FS_USERNS_MOUNT` and only requires `ns_capable(net-\u003euser_ns, CAP_SYS_ADMIN)`; the counter files are world-readable (0444), so any process inside an ordinary container also qualifies. It is not PR:N because a local account/container foothold is required.\nUI:N - The attacker performs every step itself \u2014 namespace creation, sysfs mount and file read \u2014 with no action by any other user or administrator.\nS:U - The type confusion corrupts kernel memory within the same kernel security authority; no hypervisor, IOMMU or other trust boundary is crossed, matching standard kernel privilege-escalation scoring.\nC:H - The bogus `container_of()` makes the kernel read `hw_stats_data` from uninitialized/adjacent slab memory that heap grooming can control, after which `print_hw_stat()` returns `stats-\u003evalue[index]` \u2014 an attacker-influenced pointer plus index \u2014 to userspace through `sysfs_emit()`, yielding arbitrary kernel memory disclosure.\nI:H - The fabricated `ib_device` pointer produces a wild-pointer write via `mutex_lock(\u0026stats-\u003elock)` and via `set_stats_lifespan()` on the writable `lifespan` attribute, and `update_hw_stats()` performs an indirect call through `dev-\u003eops.get_hw_stats` read from fully out-of-bounds memory, giving a control-flow hijack primitive.\nA:H - The reported and reproducible outcome is an immediate kernel NULL pointer dereference oops/panic in `hw_stat_device_show()`, which any unprivileged user or container process can trigger on demand with a single `cat`."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:56:43.154Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9a5b7f8842a90a5e6eeff37f9f6d814e61ea3529"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5212b99649c5740154f307e9e3d7fee9bf62773"
        },
        {
          "url": "https://git.kernel.org/stable/c/0cf80f924aecb5b2bebd4f4ad11b2efc676a0b78"
        },
        {
          "url": "https://git.kernel.org/stable/c/df45ae2a4f1cdfda00c032839e12092e1f32c05e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c14d9704f5d77a7c7fa46e2114b64a4f75b64e17"
        },
        {
          "url": "https://git.kernel.org/stable/c/6682da5d8fd578a5068531d01633c9d2e4c8f12b"
        },
        {
          "url": "https://git.kernel.org/stable/c/a1ecb30f90856b0be4168ad51b8875148e285c1f"
        }
      ],
      "title": "RDMA/core: Don\u0027t expose hw_counters outside of init net namespace",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22089",
    "datePublished": "2025-04-16T14:12:41.732Z",
    "dateReserved": "2024-12-29T08:45:45.817Z",
    "dateUpdated": "2026-08-05T11:56:43.154Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:58:34.645Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_skbprio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7abc8318ce0712182bf0783dcfdd9a6a8331160e",
              "status": "affected",
              "version": "aea5f654e6b78a0c976f7a25950155932c77a53f",
              "versionType": "git"
            },
            {
              "lessThan": "1284733bab736e598341f1d3f3b94e2a322864a8",
              "status": "affected",
              "version": "aea5f654e6b78a0c976f7a25950155932c77a53f",
              "versionType": "git"
            },
            {
              "lessThan": "32ee79682315e6d3c99947b3f38b078a09a66919",
              "status": "affected",
              "version": "aea5f654e6b78a0c976f7a25950155932c77a53f",
              "versionType": "git"
            },
            {
              "lessThan": "1dcc144c322a8d526b791135604c0663f1af9d85",
              "status": "affected",
              "version": "aea5f654e6b78a0c976f7a25950155932c77a53f",
              "versionType": "git"
            },
            {
              "lessThan": "864ca690ff135078d374bd565b9872f161c614bc",
              "status": "affected",
              "version": "aea5f654e6b78a0c976f7a25950155932c77a53f",
              "versionType": "git"
            },
            {
              "lessThan": "2f35b7673a3aa3d09b3eb05811669622ebaa98ca",
              "status": "affected",
              "version": "aea5f654e6b78a0c976f7a25950155932c77a53f",
              "versionType": "git"
            },
            {
              "lessThan": "2286770b07cb5268c03d11274b8efd43dff0d380",
              "status": "affected",
              "version": "aea5f654e6b78a0c976f7a25950155932c77a53f",
              "versionType": "git"
            },
            {
              "lessThan": "034b293bf17c124fec0f0e663f81203b00aa7a50",
              "status": "affected",
              "version": "aea5f654e6b78a0c976f7a25950155932c77a53f",
              "versionType": "git"
            },
            {
              "lessThan": "ce8fe975fd99b49c29c42e50f2441ba53112b2e8",
              "status": "affected",
              "version": "aea5f654e6b78a0c976f7a25950155932c77a53f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_skbprio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.292",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.236",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.180",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.292",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.236",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.180",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.134",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.87",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.23",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet_sched: skbprio: Remove overly strict queue assertions\n\nIn the current implementation, skbprio enqueue/dequeue contains an assertion\nthat fails under certain conditions when SKBPRIO is used as a child qdisc under\nTBF with specific parameters. The failure occurs because TBF sometimes peeks at\npackets in the child qdisc without actually dequeuing them when tokens are\nunavailable.\n\nThis peek operation creates a discrepancy between the parent and child qdisc\nqueue length counters. When TBF later receives a high-priority packet,\nSKBPRIO\u0027s queue length may show a different value than what\u0027s reflected in its\ninternal priority queue tracking, triggering the assertion.\n\nThe fix removes this overly strict assertions in SKBPRIO, they are not\nnecessary at all."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:32:04.448Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7abc8318ce0712182bf0783dcfdd9a6a8331160e"
        },
        {
          "url": "https://git.kernel.org/stable/c/1284733bab736e598341f1d3f3b94e2a322864a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/32ee79682315e6d3c99947b3f38b078a09a66919"
        },
        {
          "url": "https://git.kernel.org/stable/c/1dcc144c322a8d526b791135604c0663f1af9d85"
        },
        {
          "url": "https://git.kernel.org/stable/c/864ca690ff135078d374bd565b9872f161c614bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f35b7673a3aa3d09b3eb05811669622ebaa98ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/2286770b07cb5268c03d11274b8efd43dff0d380"
        },
        {
          "url": "https://git.kernel.org/stable/c/034b293bf17c124fec0f0e663f81203b00aa7a50"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce8fe975fd99b49c29c42e50f2441ba53112b2e8"
        }
      ],
      "title": "net_sched: skbprio: Remove overly strict queue assertions",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38637",
    "datePublished": "2025-04-18T07:01:34.564Z",
    "dateReserved": "2025-04-16T04:51:24.030Z",
    "dateUpdated": "2026-05-11T21:32:04.448Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/meta/fbnic/fbnic_netdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "21d3f8441c7f317b93ba6a8029610c8b7e3773db",
              "status": "affected",
              "version": "557d02238e05eb66b9aba9a1f90f3a2131c6c887",
              "versionType": "git"
            },
            {
              "lessThan": "4b59f9deff3bdb52b223c85048f1d2924803b817",
              "status": "affected",
              "version": "557d02238e05eb66b9aba9a1f90f3a2131c6c887",
              "versionType": "git"
            },
            {
              "lessThan": "4b31bcb025cb497da2b01f87173108ff32d350d2",
              "status": "affected",
              "version": "557d02238e05eb66b9aba9a1f90f3a2131c6c887",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/meta/fbnic/fbnic_netdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\neth: fbnic: unlink NAPIs from queues on error to open\n\nCI hit a UaF in fbnic in the AF_XDP portion of the queues.py test.\nThe UaF is in the __sk_mark_napi_id_once() call in xsk_bind(),\nNAPI has been freed. Looks like the device failed to open earlier,\nand we lack clearing the NAPI pointer from the queue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The dangling NAPI pointer is created by a local netdev administrative operation (link up) and dereferenced through local syscalls \u2014 `bind()` on an AF_XDP socket or a netdev-genl queue query. No remote peer data reaches this code path.\nAC:L - Once the failed open leaves the pointers dangling, the UAF is a persistent state rather than a race window, and `xsk_bind()` with `XDP_COPY` reaches `rxq-\u003enapi-\u003enapi_id` deterministically on the down device for every queue index, repeatable at will. The open failure itself is attacker-influenceable (`-ENOMEM` in `fbnic_tlv_msg_alloc()`/`request_irq()` under attacker-generated memory pressure, or an unready FW mailbox) and link-up can be retried indefinitely.\nPR:L - Both required capabilities are namespaced \u2014 `ns_capable(net-\u003euser_ns, CAP_NET_ADMIN)` for RTM_SETLINK link-up and `ns_capable(net-\u003euser_ns, CAP_NET_RAW)` for AF_XDP socket creation \u2014 so an unprivileged user in a user-namespace-owned netns with the NIC delegated (container/passthrough deployments) can perform the whole sequence without real root.\nUI:N - The attacker performs both the link-up that fails and the subsequent AF_XDP bind; no action by any other user or victim process is needed.\nS:U - The freed object and the corrupted pointers both live in kernel memory under the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free read of a freed `fbnic_napi_vector` slab object, and the attacker can spray the freed allocation before triggering the read; the value is then exfiltrated to userspace via `getsockopt(SO_INCOMING_NAPI_ID)`, giving a repeatable read primitive over reclaimed kernel heap.\nI:H - Stale `struct napi_struct *` pointers persist in the netdev\u0027s rx and tx queue structures after the backing allocation is freed; per UAF treatment this heap-reuse condition is exploitable for controlling reclaimed object contents and hijacking dependent state.\nA:H - Dereferencing the freed vector \u2014 potentially after the slab page has been returned to the page allocator \u2014 produces an oops or panic, and the condition can be re-triggered against every queue index on the affected interface."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:02:58.557Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/21d3f8441c7f317b93ba6a8029610c8b7e3773db"
        },
        {
          "url": "https://git.kernel.org/stable/c/4b59f9deff3bdb52b223c85048f1d2924803b817"
        },
        {
          "url": "https://git.kernel.org/stable/c/4b31bcb025cb497da2b01f87173108ff32d350d2"
        }
      ],
      "title": "eth: fbnic: unlink NAPIs from queues on error to open",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38570",
    "datePublished": "2025-08-19T17:02:50.677Z",
    "dateReserved": "2025-04-16T04:51:24.025Z",
    "dateUpdated": "2026-08-05T12:02:58.557Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36331",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-08T14:50:05.457904Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-08T14:50:13.442Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:31:10.979Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "AMD EPYC\u2122 9004 Series Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "unaffected",
              "version": "GenoaPI_1.0.0.F"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "EPYC\u2122 Embedded 9004  Series Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "unaffected",
              "version": "EmbGenoaPI-1.0.0.A"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "AMD EPYC\u2122 Embedded 9004 Series Processors",
          "vendor": "AMD",
          "versions": [
            {
              "status": "unaffected",
              "version": "EmbGenoaPI-1.0.0.A"
            }
          ]
        }
      ],
      "datePublic": "2025-09-06T17:09:00.562Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper initialization of CPU cache memory could allow a privileged attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity.\u003cbr\u003e"
            }
          ],
          "value": "Improper initialization of CPU cache memory could allow a privileged attacker with hypervisor access to overwrite SEV-SNP guest memory resulting in loss of data integrity."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.2,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-665",
              "description": "CWE-665  Improper Initialization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-06T17:29:38.215Z",
        "orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
        "shortName": "AMD"
      },
      "references": [
        {
          "url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-5007.html"
        },
        {
          "url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3014.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "AMD PSIRT Automation 1.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
    "assignerShortName": "AMD",
    "cveId": "CVE-2024-36331",
    "datePublished": "2025-09-06T17:29:38.215Z",
    "dateReserved": "2024-05-23T19:44:44.387Z",
    "dateUpdated": "2025-11-03T17:31:10.979Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/wangxun/libwx/wx_hw.c",
            "drivers/net/ethernet/wangxun/libwx/wx_lib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d510116c80b37efb100ce8d5ee326214b0157293",
              "status": "affected",
              "version": "3c47e8ae113a68da47987750d9896e325d0aeedd",
              "versionType": "git"
            },
            {
              "lessThan": "10e27b2a6ebeda49e9c2897a699d3ce1ded565ee",
              "status": "affected",
              "version": "3c47e8ae113a68da47987750d9896e325d0aeedd",
              "versionType": "git"
            },
            {
              "lessThan": "ee527d3fba4dae1d619d2d0438624002c8e99e24",
              "status": "affected",
              "version": "3c47e8ae113a68da47987750d9896e325d0aeedd",
              "versionType": "git"
            },
            {
              "lessThan": "d992ed7e1b687ad7df0763d3e015a5358646210b",
              "status": "affected",
              "version": "3c47e8ae113a68da47987750d9896e325d0aeedd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/wangxun/libwx/wx_hw.c",
            "drivers/net/ethernet/wangxun/libwx/wx_lib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.100",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.100",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.40",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.8",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: libwx: properly reset Rx ring descriptor\n\nWhen device reset is triggered by feature changes such as toggling Rx\nVLAN offload, wx-\u003edo_reset() is called to reinitialize Rx rings. The\nhardware descriptor ring may retain stale values from previous sessions.\nAnd only set the length to 0 in rx_desc[0] would result in building\nmalformed SKBs. Fix it to ensure a clean slate after device reset.\n\n[  549.186435] [     C16] ------------[ cut here ]------------\n[  549.186457] [     C16] kernel BUG at net/core/skbuff.c:2814!\n[  549.186468] [     C16] Oops: invalid opcode: 0000 [#1] SMP NOPTI\n[  549.186472] [     C16] CPU: 16 UID: 0 PID: 0 Comm: swapper/16 Kdump: loaded Not tainted 6.16.0-rc4+ #23 PREEMPT(voluntary)\n[  549.186476] [     C16] Hardware name: Micro-Star International Co., Ltd. MS-7E16/X670E GAMING PLUS WIFI (MS-7E16), BIOS 1.90 12/31/2024\n[  549.186478] [     C16] RIP: 0010:__pskb_pull_tail+0x3ff/0x510\n[  549.186484] [     C16] Code: 06 f0 ff 4f 34 74 7b 4d 8b 8c 24 c8 00 00 00 45 8b 84 24 c0 00 00 00 e9 c8 fd ff ff 48 c7 44 24 08 00 00 00 00 e9 5e fe ff ff \u003c0f\u003e 0b 31 c0 e9 23 90 5b ff 41 f7 c6 ff 0f 00 00 75 bf 49 8b 06 a8\n[  549.186487] [     C16] RSP: 0018:ffffb391c0640d70 EFLAGS: 00010282\n[  549.186490] [     C16] RAX: 00000000fffffff2 RBX: ffff8fe7e4d40200 RCX: 00000000fffffff2\n[  549.186492] [     C16] RDX: ffff8fe7c3a4bf8e RSI: 0000000000000180 RDI: ffff8fe7c3a4bf40\n[  549.186494] [     C16] RBP: ffffb391c0640da8 R08: ffff8fe7c3a4c0c0 R09: 000000000000000e\n[  549.186496] [     C16] R10: ffffb391c0640d88 R11: 000000000000000e R12: ffff8fe7e4d40200\n[  549.186497] [     C16] R13: 00000000fffffff2 R14: ffff8fe7fa01a000 R15: 00000000fffffff2\n[  549.186499] [     C16] FS:  0000000000000000(0000) GS:ffff8fef5ae40000(0000) knlGS:0000000000000000\n[  549.186502] [     C16] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  549.186503] [     C16] CR2: 00007f77d81d6000 CR3: 000000051a032000 CR4: 0000000000750ef0\n[  549.186505] [     C16] PKRU: 55555554\n[  549.186507] [     C16] Call Trace:\n[  549.186510] [     C16]  \u003cIRQ\u003e\n[  549.186513] [     C16]  ? srso_alias_return_thunk+0x5/0xfbef5\n[  549.186517] [     C16]  __skb_pad+0xc7/0xf0\n[  549.186523] [     C16]  wx_clean_rx_irq+0x355/0x3b0 [libwx]\n[  549.186533] [     C16]  wx_poll+0x92/0x120 [libwx]\n[  549.186540] [     C16]  __napi_poll+0x28/0x190\n[  549.186544] [     C16]  net_rx_action+0x301/0x3f0\n[  549.186548] [     C16]  ? srso_alias_return_thunk+0x5/0xfbef5\n[  549.186551] [     C16]  ? __raw_spin_lock_irqsave+0x1e/0x50\n[  549.186554] [     C16]  ? srso_alias_return_thunk+0x5/0xfbef5\n[  549.186557] [     C16]  ? wake_up_nohz_cpu+0x35/0x160\n[  549.186559] [     C16]  ? srso_alias_return_thunk+0x5/0xfbef5\n[  549.186563] [     C16]  handle_softirqs+0xf9/0x2c0\n[  549.186568] [     C16]  __irq_exit_rcu+0xc7/0x130\n[  549.186572] [     C16]  common_interrupt+0xb8/0xd0\n[  549.186576] [     C16]  \u003c/IRQ\u003e\n[  549.186577] [     C16]  \u003cTASK\u003e\n[  549.186579] [     C16]  asm_common_interrupt+0x22/0x40\n[  549.186582] [     C16] RIP: 0010:cpuidle_enter_state+0xc2/0x420\n[  549.186585] [     C16] Code: 00 00 e8 11 0e 5e ff e8 ac f0 ff ff 49 89 c5 0f 1f 44 00 00 31 ff e8 0d ed 5c ff 45 84 ff 0f 85 40 02 00 00 fb 0f 1f 44 00 00 \u003c45\u003e 85 f6 0f 88 84 01 00 00 49 63 d6 48 8d 04 52 48 8d 04 82 49 8d\n[  549.186587] [     C16] RSP: 0018:ffffb391c0277e78 EFLAGS: 00000246\n[  549.186590] [     C16] RAX: ffff8fef5ae40000 RBX: 0000000000000003 RCX: 0000000000000000\n[  549.186591] [     C16] RDX: 0000007fde0faac5 RSI: ffffffff826e53f6 RDI: ffffffff826fa9b3\n[  549.186593] [     C16] RBP: ffff8fe7c3a20800 R08: 0000000000000002 R09: 0000000000000000\n[  549.186595] [     C16] R10: 0000000000000000 R11: 000000000000ffff R12: ffffffff82ed7a40\n[  549.186596] [     C16] R13: 0000007fde0faac5 R14: 0000000000000003 R15: 0000000000000000\n[  549.186601] [     C16]  ? cpuidle_enter_state+0xb3/0x420\n[  549.186605] [     C16]  cpuidle_en\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is armed by a local device reset triggered through ethtool (`ethtool -K rxvlan`, `-C rx-usecs`, `-L`) reaching `wx_set_features()`/`wx_set_rx_itr()` \u2192 `txgbe_do_reset()`; no remote peer can induce a ring reinitialization since the driver has no `ndo_tx_timeout` or other packet-driven reset path.\nAC:L - The condition is fully deterministic: after every reset, descriptor 0 always retains its stale `DD|EOP` writeback because `wx_alloc_rx_buffers()` clears `status_error` only after incrementing past it and the ring is never zeroed, so the first NAPI poll after the reset processes the bogus descriptor with no race, timing window, or memory-layout dependency.\nPR:L - The triggering ethtool set-operations are gated by `ns_capable(net-\u003euser_ns, CAP_NET_ADMIN)` and `GENL_UNS_ADMIN_PERM`, i.e. namespaced capabilities, so an unprivileged user who is root in a user namespace owning the netns that holds the interface (a routine SR-IOV/delegated-NIC container setup) can perform the feature toggle.\nUI:N - The attacker performs the feature toggle themselves and the corrupted descriptor is consumed automatically by the NAPI poll on the next received frame; no separate victim has to mount, open, or launch anything.\nS:U - The wild-pointer read, the malformed skb, and the resulting BUG() all occur within the kernel that owns the driver and the network stack; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `wx_pull_tail()` runs on an skb with `nr_frags == 0`, dereferencing an uninitialized `skb_shinfo()-\u003efrags[0]` and copying up to 256 bytes from an arbitrary kernel address into the skb\u0027s linear data, which is then handed to `napi_gro_receive()` for delivery to local sockets or forwarding onto the wire; the resulting `skb_headlen()` (74) also exceeds the real 60 bytes of data, giving further out-of-bounds reads.\nI:H - `skb-\u003edata_len -= pull_len` underflows to 0xfffffff2 and `skb_frag_size_sub()` writes through the garbage frag descriptor, so an skb whose `len`/`data_len`/`headlen` are mutually inconsistent is injected into the network stack, where the resulting size arithmetic drives out-of-bounds copies \u2014 kernel memory corruption at addresses the driver does not own.\nA:H - The commit message documents the concrete outcome: `kernel BUG at net/core/skbuff.c:2814` in `__pskb_pull_tail()` from `__skb_pad()` in `wx_clean_rx_irq()`, an unrecoverable panic in softirq context, and the wild frag pointer can independently fault on an unmapped address."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:02:42.423Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d510116c80b37efb100ce8d5ee326214b0157293"
        },
        {
          "url": "https://git.kernel.org/stable/c/10e27b2a6ebeda49e9c2897a699d3ce1ded565ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee527d3fba4dae1d619d2d0438624002c8e99e24"
        },
        {
          "url": "https://git.kernel.org/stable/c/d992ed7e1b687ad7df0763d3e015a5358646210b"
        }
      ],
      "title": "net: libwx: properly reset Rx ring descriptor",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38532",
    "datePublished": "2025-08-16T11:12:25.161Z",
    "dateReserved": "2025-04-16T04:51:24.023Z",
    "dateUpdated": "2026-08-05T12:02:42.423Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-bufio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "469a39a33a9934af157299bf11c58f6e6cb53f85",
              "status": "affected",
              "version": "450e8dee51aa6fa1dd0f64073e88235f1a77b035",
              "versionType": "git"
            },
            {
              "lessThan": "68860d1ade385eef9fcdbf6552f061283091fdb8",
              "status": "affected",
              "version": "450e8dee51aa6fa1dd0f64073e88235f1a77b035",
              "versionType": "git"
            },
            {
              "lessThan": "3edfdb1d4ef81320dae0caa40bc24baf8c1bbb86",
              "status": "affected",
              "version": "450e8dee51aa6fa1dd0f64073e88235f1a77b035",
              "versionType": "git"
            },
            {
              "lessThan": "b1bf1a782fdf5c482215c0c661b5da98b8e75773",
              "status": "affected",
              "version": "450e8dee51aa6fa1dd0f64073e88235f1a77b035",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/dm-bufio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.100",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.100",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.40",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.8",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-bufio: fix sched in atomic context\n\nIf \"try_verify_in_tasklet\" is set for dm-verity, DM_BUFIO_CLIENT_NO_SLEEP\nis enabled for dm-bufio. However, when bufio tries to evict buffers, there\nis a chance to trigger scheduling in spin_lock_bh, the following warning\nis hit:\n\nBUG: sleeping function called from invalid context at drivers/md/dm-bufio.c:2745\nin_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 123, name: kworker/2:2\npreempt_count: 201, expected: 0\nRCU nest depth: 0, expected: 0\n4 locks held by kworker/2:2/123:\n #0: ffff88800a2d1548 ((wq_completion)dm_bufio_cache){....}-{0:0}, at: process_one_work+0xe46/0x1970\n #1: ffffc90000d97d20 ((work_completion)(\u0026dm_bufio_replacement_work)){....}-{0:0}, at: process_one_work+0x763/0x1970\n #2: ffffffff8555b528 (dm_bufio_clients_lock){....}-{3:3}, at: do_global_cleanup+0x1ce/0x710\n #3: ffff88801d5820b8 (\u0026c-\u003espinlock){....}-{2:2}, at: do_global_cleanup+0x2a5/0x710\nPreemption disabled at:\n[\u003c0000000000000000\u003e] 0x0\nCPU: 2 UID: 0 PID: 123 Comm: kworker/2:2 Not tainted 6.16.0-rc3-g90548c634bd0 #305 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\nWorkqueue: dm_bufio_cache do_global_cleanup\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x53/0x70\n __might_resched+0x360/0x4e0\n do_global_cleanup+0x2f5/0x710\n process_one_work+0x7db/0x1970\n worker_thread+0x518/0xea0\n kthread+0x359/0x690\n ret_from_fork+0xf3/0x1b0\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\nThat can be reproduced by:\n\n  veritysetup format --data-block-size=4096 --hash-block-size=4096 /dev/vda /dev/vdb\n  SIZE=$(blockdev --getsz /dev/vda)\n  dmsetup create myverity -r --table \"0 $SIZE verity 1 /dev/vda /dev/vdb 4096 4096 \u003cdata_blocks\u003e 1 sha256 \u003croot_hash\u003e \u003csalt\u003e 1 try_verify_in_tasklet\"\n  mount /dev/dm-0 /mnt -o ro\n  echo 102400 \u003e /sys/module/dm_bufio/parameters/max_cache_size_bytes\n  [read files in /mnt]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:29:08.636Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/469a39a33a9934af157299bf11c58f6e6cb53f85"
        },
        {
          "url": "https://git.kernel.org/stable/c/68860d1ade385eef9fcdbf6552f061283091fdb8"
        },
        {
          "url": "https://git.kernel.org/stable/c/3edfdb1d4ef81320dae0caa40bc24baf8c1bbb86"
        },
        {
          "url": "https://git.kernel.org/stable/c/b1bf1a782fdf5c482215c0c661b5da98b8e75773"
        }
      ],
      "title": "dm-bufio: fix sched in atomic context",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38496",
    "datePublished": "2025-07-28T11:22:05.091Z",
    "dateReserved": "2025-04-16T04:51:24.022Z",
    "dateUpdated": "2026-05-11T21:29:08.636Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/mediatek/mtk_dp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "13ec849fd2eab808ee8eba2625df7ebea3b85edf",
              "status": "affected",
              "version": "7eacba9a083be65c0f251c19380ec01147c01ebc",
              "versionType": "git"
            },
            {
              "lessThan": "57a9fb47551b33cde7b76d17c0072c3b394f4620",
              "status": "affected",
              "version": "7eacba9a083be65c0f251c19380ec01147c01ebc",
              "versionType": "git"
            },
            {
              "lessThan": "2fda391ef7a701748abd7fa32232981b522c1e07",
              "status": "affected",
              "version": "7eacba9a083be65c0f251c19380ec01147c01ebc",
              "versionType": "git"
            },
            {
              "lessThan": "149a5c38436c229950cf1020992ce65c9549bc19",
              "status": "affected",
              "version": "7eacba9a083be65c0f251c19380ec01147c01ebc",
              "versionType": "git"
            },
            {
              "lessThan": "106a6de46cf4887d535018185ec528ce822d6d84",
              "status": "affected",
              "version": "7eacba9a083be65c0f251c19380ec01147c01ebc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/mediatek/mtk_dp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.87",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.23",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: dp: drm_err =\u003e dev_err in HPD path to avoid NULL ptr\n\nThe function mtk_dp_wait_hpd_asserted() may be called before the\n`mtk_dp-\u003edrm_dev` pointer is assigned in mtk_dp_bridge_attach().\nSpecifically it can be called via this callpath:\n - mtk_edp_wait_hpd_asserted\n - [panel probe]\n - dp_aux_ep_probe\n\nUsing \"drm\" level prints anywhere in this callpath causes a NULL\npointer dereference. Change the error message directly in\nmtk_dp_wait_hpd_asserted() to dev_err() to avoid this. Also change the\nerror messages in mtk_dp_parse_capabilities(), which is called by\nmtk_dp_wait_hpd_asserted().\n\nWhile touching these prints, also add the error code to them to make\nfuture debugging easier."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:23:56.828Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/13ec849fd2eab808ee8eba2625df7ebea3b85edf"
        },
        {
          "url": "https://git.kernel.org/stable/c/57a9fb47551b33cde7b76d17c0072c3b394f4620"
        },
        {
          "url": "https://git.kernel.org/stable/c/2fda391ef7a701748abd7fa32232981b522c1e07"
        },
        {
          "url": "https://git.kernel.org/stable/c/149a5c38436c229950cf1020992ce65c9549bc19"
        },
        {
          "url": "https://git.kernel.org/stable/c/106a6de46cf4887d535018185ec528ce822d6d84"
        }
      ],
      "title": "drm/mediatek: dp: drm_err =\u003e dev_err in HPD path to avoid NULL ptr",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38240",
    "datePublished": "2025-04-18T07:01:32.338Z",
    "dateReserved": "2025-04-16T04:51:23.996Z",
    "dateUpdated": "2026-05-11T21:23:56.828Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:39:14.400Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e2c8a3c0388aef6bfc4aabfba07bc7dff16eea80",
              "status": "affected",
              "version": "79720743421753ff72bfa0d79976c534645b81c1",
              "versionType": "git"
            },
            {
              "lessThan": "ec6392061de6681148b63ee6c8744da833498cdd",
              "status": "affected",
              "version": "986e43b19ae9176093da35e0a844e65c8bf9ede7",
              "versionType": "git"
            },
            {
              "lessThan": "e01851f6e9a665a6011b14714b271d3e6b0b8d32",
              "status": "affected",
              "version": "986e43b19ae9176093da35e0a844e65c8bf9ede7",
              "versionType": "git"
            },
            {
              "lessThan": "6e3b09402cc6c3e3474fa548e8adf6897dda05de",
              "status": "affected",
              "version": "986e43b19ae9176093da35e0a844e65c8bf9ede7",
              "versionType": "git"
            },
            {
              "lessThan": "737bb912ebbe4571195c56eba557c4d7315b26fb",
              "status": "affected",
              "version": "986e43b19ae9176093da35e0a844e65c8bf9ede7",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.146",
              "status": "affected",
              "version": "6.1.107",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.146",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.99",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.146",
                  "versionStartIncluding": "6.1.107",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.99",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.39",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.7",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: prevent A-MSDU attacks in mesh networks\n\nThis patch is a mitigation to prevent the A-MSDU spoofing vulnerability\nfor mesh networks. The initial update to the IEEE 802.11 standard, in\nresponse to the FragAttacks, missed this case (CVE-2025-27558). It can\nbe considered a variant of CVE-2020-24588 but for mesh networks.\n\nThis patch tries to detect if a standard MSDU was turned into an A-MSDU\nby an adversary. This is done by parsing a received A-MSDU as a standard\nMSDU, calculating the length of the Mesh Control header, and seeing if\nthe 6 bytes after this header equal the start of an rfc1042 header. If\nequal, this is a strong indication of an ongoing attack attempt.\n\nThis defense was tested with mac80211_hwsim against a mesh network that\nuses an empty Mesh Address Extension field, i.e., when four addresses\nare used, and when using a 12-byte Mesh Address Extension field, i.e.,\nwhen six addresses are used. Functionality of normal MSDUs and A-MSDUs\nwas also tested, and confirmed working, when using both an empty and\n12-byte Mesh Address Extension field.\n\nIt was also tested with mac80211_hwsim that A-MSDU attacks in non-mesh\nnetworks keep being detected and prevented.\n\nNote that the vulnerability being patched, and the defense being\nimplemented, was also discussed in the following paper and in the\nfollowing IEEE 802.11 presentation:\n\nhttps://papers.mathyvanhoef.com/wisec2025.pdf\nhttps://mentor.ieee.org/802.11/dcn/25/11-25-0949-00-000m-a-msdu-mesh-spoof-protection.docx"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - Exploitation requires the attacker to capture and re-inject 802.11 frames within radio range of the target mesh network, flipping the unauthenticated A-MSDU-Present bit in the QoS Control field. This is Wi-Fi frame injection on the same wireless segment, which maps to Adjacent.\nAC:L - The attacker controls every precondition: a monitor-mode radio, a standard channel-based MitM to relay the frame (as in KRACK/FragAttacks tooling), and causing known plaintext to traverse the link by simply sending traffic toward the victim; the parsing outcome is deterministic once the bit is flipped. 802.11s mesh is a mainstream deployment (OpenWrt/IoT/smart-home routers) and SPP A-MSDU protection is essentially never negotiated in practice.\nPR:N - The attacker holds no credentials on the mesh network \u2014 the frame is legitimately encrypted and MIC-validated by an authenticated peer, and only an unprotected header bit outside the cryptographic integrity check is modified. No authentication or authorization is required at any point on the path.\nUI:N - No victim action is needed; the attacker can elicit the required frame by sending unsolicited traffic toward the victim or by acting on routinely present mesh/broadcast traffic. Parsing happens automatically in the receive path.\nS:U - The injected frames are processed and forwarded by the same kernel networking stack that contains the flaw, which is that component\u0027s normal authority. No VM, IOMMU, or hypervisor boundary is crossed.\nC:H - Bypassing the link-layer integrity guarantee lets an unauthenticated attacker inject frames that poison the mesh proxy path table (`mpp_path_add()`), redirecting traffic destined for arbitrary addresses to a node of the attacker\u0027s choosing, and enables the documented FragAttacks chain (spoofed router advertisement/DNS) to intercept the victim\u0027s entire traffic stream. Data that WPA2/WPA3 is supposed to protect becomes readable by the attacker.\nI:H - The attacker gains arbitrary Ethernet/IP packet injection into a cryptographically protected mesh, with the frames attributed to a legitimately authenticated peer and forwarded across the whole mesh and out its gateway. Attacker-controlled Mesh Control headers additionally allow rewriting the node\u0027s mesh proxy/routing state, a complete loss of integrity for traffic handled by the interface.\nA:H - Persistently poisoning the mesh proxy path table lets the attacker blackhole traffic for arbitrary destinations, including the mesh gateway, cutting off forwarding for the affected node and downstream clients; injected frames can also tear down connections at will. For a mesh router whose function is forwarding, this is a total loss of the affected service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:02:33.752Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e2c8a3c0388aef6bfc4aabfba07bc7dff16eea80"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec6392061de6681148b63ee6c8744da833498cdd"
        },
        {
          "url": "https://git.kernel.org/stable/c/e01851f6e9a665a6011b14714b271d3e6b0b8d32"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e3b09402cc6c3e3474fa548e8adf6897dda05de"
        },
        {
          "url": "https://git.kernel.org/stable/c/737bb912ebbe4571195c56eba557c4d7315b26fb"
        }
      ],
      "title": "wifi: prevent A-MSDU attacks in mesh networks",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38512",
    "datePublished": "2025-08-16T10:54:54.285Z",
    "dateReserved": "2025-04-16T04:51:24.022Z",
    "dateUpdated": "2026-08-05T12:02:33.752Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:41:09.284Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/netfilter/nf_socket_ipv6.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6488b96a79a26e19100ad872622f04e93b638d7f",
              "status": "affected",
              "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a",
              "versionType": "git"
            },
            {
              "lessThan": "58ab63d3ded2ca6141357a2b24eee8453d0f871d",
              "status": "affected",
              "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a",
              "versionType": "git"
            },
            {
              "lessThan": "1ca2169cc19dca893c7aae6af122852097435d16",
              "status": "affected",
              "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a",
              "versionType": "git"
            },
            {
              "lessThan": "1ec43100f7123010730b7ddfc3d5c2eac19e70e7",
              "status": "affected",
              "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a",
              "versionType": "git"
            },
            {
              "lessThan": "5251041573850e5020cd447374e23010be698898",
              "status": "affected",
              "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a",
              "versionType": "git"
            },
            {
              "lessThan": "2bb139e483f8cbe488d19d8c1135ac3615e2668c",
              "status": "affected",
              "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a",
              "versionType": "git"
            },
            {
              "lessThan": "41904cbb343d115931d6bf79aa2c815cac4ef72b",
              "status": "affected",
              "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a",
              "versionType": "git"
            },
            {
              "lessThan": "221c27259324ec1404f028d4f5a0f2ae7f63ee23",
              "status": "affected",
              "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a",
              "versionType": "git"
            },
            {
              "lessThan": "932b32ffd7604fb00b5c57e239a3cc4d901ccf6e",
              "status": "affected",
              "version": "eb31628e37a0a4e01fffd79dcc7f815d2357f53a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/netfilter/nf_socket_ipv6.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "lessThan": "3.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.292",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.236",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.180",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.133",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.292",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.236",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.180",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.133",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.86",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.22",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.10",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.1",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: socket: Lookup orig tuple for IPv6 SNAT\n\nnf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to\nrestore the original 5-tuple in case of SNAT, to be able to find the\nright socket (if any). Then socket_match() can correctly check whether\nthe socket was transparent.\n\nHowever, the IPv6 counterpart (nf_sk_lookup_slow_v6) lacks this\nconntrack lookup, making xt_socket fail to match on the socket when the\npacket was SNATed. Add the same logic to nf_sk_lookup_slow_v6.\n\nIPv6 SNAT is used in Kubernetes clusters for pod-to-world packets, as\npods\u0027 addresses are in the fd00::/8 ULA subnet and need to be replaced\nwith the node\u0027s external address. Cilium leverages Envoy to enforce L7\npolicies, and Envoy uses transparent sockets. Cilium inserts an iptables\nprerouting rule that matches on `-m socket --transparent` and redirects\nthe packets to localhost, but it fails to match SNATed IPv6 packets due\nto that missing conntrack lookup."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The defective lookup executes in the netfilter PREROUTING path on IPv6 packets received from a remote peer; no local access is involved, and the enforcement failure manifests on unsolicited inbound reply traffic from arbitrary internet hosts.\nAC:L - The missing conntrack original-tuple lookup fails deterministically for every SNATed IPv6 reply flow \u2014 there is no race, timing window, or memory-layout precondition, and hook ordering (mangle -150 before NAT_DST -100) guarantees the socket is never found.\nPR:N - The packet that triggers the mis-lookup arrives from an unauthenticated off-node peer that holds no credentials on the target, and the resulting bypass of the transparent-proxy diversion rule requires no privileges anywhere in the path.\nUI:N - Packets are processed automatically by the netfilter hooks on receipt; no administrator or user action is needed for the socket match to fail.\nS:C - The vulnerable component is the kernel\u0027s packet-filtering/redirection engine, but the impacted resources are the workloads it protects \u2014 pods in separate network namespaces and the userspace L7 policy authority (Envoy) whose enforcement point is bypassed \u2014 matching the CVSS filtering-component-fails-to-protect-downstream-systems case.\nC:H - Bypassing the transparent-proxy diversion means traffic that L7 policy was meant to inspect and restrict flows uninspected, allowing a workload or remote peer to reach and retrieve data from endpoints the policy forbids; the same failure defeats `socket cgroupv2`/`socket mark` based nftables access rules.\nI:H - Unauthorized, uninspected traffic is delivered to protected workloads instead of the enforcement proxy, breaking the \"all traffic traverses the policy point\" invariant and letting an attacker inject content past the L7 filter into the protected component.\nA:H - Where the ruleset is fail-closed, reply packets never reach the transparent socket at all, so every SNATed IPv6 proxied connection breaks \u2014 a complete loss of availability for the affected service, which is exactly the symptom reported against Cilium (issue #37932)."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:56:03.614Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6488b96a79a26e19100ad872622f04e93b638d7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/58ab63d3ded2ca6141357a2b24eee8453d0f871d"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ca2169cc19dca893c7aae6af122852097435d16"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ec43100f7123010730b7ddfc3d5c2eac19e70e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/5251041573850e5020cd447374e23010be698898"
        },
        {
          "url": "https://git.kernel.org/stable/c/2bb139e483f8cbe488d19d8c1135ac3615e2668c"
        },
        {
          "url": "https://git.kernel.org/stable/c/41904cbb343d115931d6bf79aa2c815cac4ef72b"
        },
        {
          "url": "https://git.kernel.org/stable/c/221c27259324ec1404f028d4f5a0f2ae7f63ee23"
        },
        {
          "url": "https://git.kernel.org/stable/c/932b32ffd7604fb00b5c57e239a3cc4d901ccf6e"
        }
      ],
      "title": "netfilter: socket: Lookup orig tuple for IPv6 SNAT",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22021",
    "datePublished": "2025-04-16T10:20:37.695Z",
    "dateReserved": "2024-12-29T08:45:45.807Z",
    "dateUpdated": "2026-08-05T11:56:03.614Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:39:38.181Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/appletalk/ddp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b92bedf71f25303e203a4e657489d76691a58119",
              "status": "affected",
              "version": "c7f905f0f6d49ed8c1aa4566c31f0383a0ba0c9d",
              "versionType": "git"
            },
            {
              "lessThan": "a7852b01793669248dce0348d14df89e77a32afd",
              "status": "affected",
              "version": "c7f905f0f6d49ed8c1aa4566c31f0383a0ba0c9d",
              "versionType": "git"
            },
            {
              "lessThan": "b2f5dfa87367fdce9f8b995bc6c38f64f9ea2c90",
              "status": "affected",
              "version": "c7f905f0f6d49ed8c1aa4566c31f0383a0ba0c9d",
              "versionType": "git"
            },
            {
              "lessThan": "d2e9f50f0bdad73b64a871f25186b899624518c4",
              "status": "affected",
              "version": "c7f905f0f6d49ed8c1aa4566c31f0383a0ba0c9d",
              "versionType": "git"
            },
            {
              "lessThan": "4a17370da6e476d3d275534e9e9cd2d02c57ca46",
              "status": "affected",
              "version": "c7f905f0f6d49ed8c1aa4566c31f0383a0ba0c9d",
              "versionType": "git"
            },
            {
              "lessThan": "473f3eadfc73b0fb6d8dee5829d19a5772e387f7",
              "status": "affected",
              "version": "c7f905f0f6d49ed8c1aa4566c31f0383a0ba0c9d",
              "versionType": "git"
            },
            {
              "lessThan": "64124cf0aab0dd1e18c0fb5ae66e45741e727f8b",
              "status": "affected",
              "version": "c7f905f0f6d49ed8c1aa4566c31f0383a0ba0c9d",
              "versionType": "git"
            },
            {
              "lessThan": "711c80f7d8b163d3ecd463cd96f07230f488e750",
              "status": "affected",
              "version": "c7f905f0f6d49ed8c1aa4566c31f0383a0ba0c9d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/appletalk/ddp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.296",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.240",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.146",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.99",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.296",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.240",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.189",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.146",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.99",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.39",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.7",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: appletalk: Fix device refcount leak in atrtr_create()\n\nWhen updating an existing route entry in atrtr_create(), the old device\nreference was not being released before assigning the new device,\nleading to a device refcount leak. Fix this by calling dev_put() to\nrelease the old device reference before holding the new one."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached via `ioctl(SIOCADDRT)` on a locally-created `AF_APPLETALK` socket, requiring local system access. There is no remote or adjacent-network trigger for `atrtr_create()`.\nAC:L - The leak is fully deterministic \u2014 issuing the same `SIOCADDRT` twice for one route target/flags pair leaks a reference on every subsequent call, with no race, timing window, or memory-layout dependency. The attacker controls the loop entirely and `appletalk.ko` autoloads on demand.\nPR:L - The 32-bit compat path `atalk_compat_routing_ioctl()` reaches `atrtr_create()` with no capability check whatsoever (dropped in v5.6 by dc13c8761c91c0), and `compat_sock_ioctl()` dispatches to it before any generic gating, so an ordinary unprivileged user account suffices. Only the native path enforces `capable(CAP_NET_ADMIN)`.\nUI:N - The attacker triggers the entire sequence from their own process with socket creation and repeated ioctls. No victim action or cooperation is involved.\nS:U - The leaked reference, the resulting hang, and any subsequent memory corruption are all confined to the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The netdev refcount is an unprotected wrappable `int` (`this_cpu_inc` on `pcpu_refcnt`, no `refcount_t` saturation), so sustained leaking wraps `netdev_refcnt_read()` and causes `free_netdev()` while live references remain. The resulting use-after-free on `struct net_device` \u2014 still referenced by routes, qdiscs and sockets \u2014 yields an arbitrary kernel read primitive after heap reclaim.\nI:H - The same refcount wrap produces a dangling `struct net_device`, an object dense with function-pointer tables (`netdev_ops`, `ethtool_ops`, `header_ops`) that is straightforward to reclaim and spray, giving a write and control-flow hijack primitive. Per kernel scoring guidance, use-after-free is rated High for integrity.\nA:H - Each leaked reference makes the device permanently unremovable \u2014 `netdev_wait_allrefs_any()` spins forever from `netdev_run_todo()`, wedging the single-threaded `cleanup_net` workqueue so all further netns teardown and RTNL device removal hangs system-wide until reboot. The `BUG_ON(netdev_refcnt_read(dev) != 1)` in `netdev_run_todo()` additionally gives a directly reachable kernel panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:02:46.709Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b92bedf71f25303e203a4e657489d76691a58119"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7852b01793669248dce0348d14df89e77a32afd"
        },
        {
          "url": "https://git.kernel.org/stable/c/b2f5dfa87367fdce9f8b995bc6c38f64f9ea2c90"
        },
        {
          "url": "https://git.kernel.org/stable/c/d2e9f50f0bdad73b64a871f25186b899624518c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a17370da6e476d3d275534e9e9cd2d02c57ca46"
        },
        {
          "url": "https://git.kernel.org/stable/c/473f3eadfc73b0fb6d8dee5829d19a5772e387f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/64124cf0aab0dd1e18c0fb5ae66e45741e727f8b"
        },
        {
          "url": "https://git.kernel.org/stable/c/711c80f7d8b163d3ecd463cd96f07230f488e750"
        }
      ],
      "title": "net: appletalk: Fix device refcount leak in atrtr_create()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38542",
    "datePublished": "2025-08-16T11:22:16.689Z",
    "dateReserved": "2025-04-16T04:51:24.024Z",
    "dateUpdated": "2026-08-05T12:02:46.709Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "lib/alloc_tag.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "febc0b5dbabda414565bdfaaaa59d26f787d5fe7",
              "status": "affected",
              "version": "1438d349d16b78d88f9e978a4a5496f078c8191b",
              "versionType": "git"
            },
            {
              "lessThan": "22bf79c0c2301b6e15a688220284b147774d277e",
              "status": "affected",
              "version": "1438d349d16b78d88f9e978a4a5496f078c8191b",
              "versionType": "git"
            },
            {
              "lessThan": "99af22cd34688cc0d535a1919e0bea4cbc6c1ea1",
              "status": "affected",
              "version": "1438d349d16b78d88f9e978a4a5496f078c8191b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "lib/alloc_tag.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.39",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.7",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users()\n\nalloc_tag_top_users() attempts to lock alloc_tag_cttype-\u003emod_lock even\nwhen the alloc_tag_cttype is not allocated because:\n\n  1) alloc tagging is disabled because mem profiling is disabled\n     (!alloc_tag_cttype)\n  2) alloc tagging is enabled, but not yet initialized (!alloc_tag_cttype)\n  3) alloc tagging is enabled, but failed initialization\n     (!alloc_tag_cttype or IS_ERR(alloc_tag_cttype))\n\nIn all cases, alloc_tag_cttype is not allocated, and therefore\nalloc_tag_top_users() should not attempt to acquire the semaphore.\n\nThis leads to a crash on memory allocation failure by attempting to\nacquire a non-existent semaphore:\n\n  Oops: general protection fault, probably for non-canonical address 0xdffffc000000001b: 0000 [#3] SMP KASAN NOPTI\n  KASAN: null-ptr-deref in range [0x00000000000000d8-0x00000000000000df]\n  CPU: 2 UID: 0 PID: 1 Comm: systemd Tainted: G      D             6.16.0-rc2 #1 VOLUNTARY\n  Tainted: [D]=DIE\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\n  RIP: 0010:down_read_trylock+0xaa/0x3b0\n  Code: d0 7c 08 84 d2 0f 85 a0 02 00 00 8b 0d df 31 dd 04 85 c9 75 29 48 b8 00 00 00 00 00 fc ff df 48 8d 6b 68 48 89 ea 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 88 02 00 00 48 3b 5b 68 0f 85 53 01 00 00 65 ff\n  RSP: 0000:ffff8881002ce9b8 EFLAGS: 00010016\n  RAX: dffffc0000000000 RBX: 0000000000000070 RCX: 0000000000000000\n  RDX: 000000000000001b RSI: 000000000000000a RDI: 0000000000000070\n  RBP: 00000000000000d8 R08: 0000000000000001 R09: ffffed107dde49d1\n  R10: ffff8883eef24e8b R11: ffff8881002cec20 R12: 1ffff11020059d37\n  R13: 00000000003fff7b R14: ffff8881002cec20 R15: dffffc0000000000\n  FS:  00007f963f21d940(0000) GS:ffff888458ca6000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007f963f5edf71 CR3: 000000010672c000 CR4: 0000000000350ef0\n  Call Trace:\n   \u003cTASK\u003e\n   codetag_trylock_module_list+0xd/0x20\n   alloc_tag_top_users+0x369/0x4b0\n   __show_mem+0x1cd/0x6e0\n   warn_alloc+0x2b1/0x390\n   __alloc_frozen_pages_noprof+0x12b9/0x21a0\n   alloc_pages_mpol+0x135/0x3e0\n   alloc_slab_page+0x82/0xe0\n   new_slab+0x212/0x240\n   ___slab_alloc+0x82a/0xe00\n   \u003c/TASK\u003e\n\nAs David Wang points out, this issue became easier to trigger after commit\n780138b12381 (\"alloc_tag: check mem_profiling_support in alloc_tag_init\").\n\nBefore the commit, the issue occurred only when it failed to allocate and\ninitialize alloc_tag_cttype or if a memory allocation fails before\nalloc_tag_init() is called.  After the commit, it can be easily triggered\nwhen memory profiling is compiled but disabled at boot.\n\nTo properly determine whether alloc_tag_init() has been called and its\ndata structures initialized, verify that alloc_tag_cttype is a valid\npointer before acquiring the semaphore.  If the variable is NULL or an\nerror value, it has not been properly initialized.  In such a case, just\nskip and do not attempt to acquire the semaphore.\n\n[harry.yoo@oracle.com: v3]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:29:33.070Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/febc0b5dbabda414565bdfaaaa59d26f787d5fe7"
        },
        {
          "url": "https://git.kernel.org/stable/c/22bf79c0c2301b6e15a688220284b147774d277e"
        },
        {
          "url": "https://git.kernel.org/stable/c/99af22cd34688cc0d535a1919e0bea4cbc6c1ea1"
        }
      ],
      "title": "lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38517",
    "datePublished": "2025-08-16T10:55:04.217Z",
    "dateReserved": "2025-04-16T04:51:24.023Z",
    "dateUpdated": "2026-05-11T21:29:33.070Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-23136",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T17:03:06.730334Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T17:03:09.639Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:42:20.085Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:40:53.776Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/thermal/intel/int340x_thermal/int3402_thermal.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d0d21c8e44216fa9afdb3809edf213f3c0a8c060",
              "status": "affected",
              "version": "77e337c6e23e3b9d22e09ffec202a80f755a54c2",
              "versionType": "git"
            },
            {
              "lessThan": "bc7b5f782d28942dbdfda70df30ce132694a06de",
              "status": "affected",
              "version": "77e337c6e23e3b9d22e09ffec202a80f755a54c2",
              "versionType": "git"
            },
            {
              "lessThan": "3155d5261b518776d1b807d9d922669991bbee56",
              "status": "affected",
              "version": "77e337c6e23e3b9d22e09ffec202a80f755a54c2",
              "versionType": "git"
            },
            {
              "lessThan": "6a810c462f099353e908c70619638884cb82229c",
              "status": "affected",
              "version": "77e337c6e23e3b9d22e09ffec202a80f755a54c2",
              "versionType": "git"
            },
            {
              "lessThan": "ac2eb7378319e3836cdf3a2c15a0bdf04c50e81d",
              "status": "affected",
              "version": "77e337c6e23e3b9d22e09ffec202a80f755a54c2",
              "versionType": "git"
            },
            {
              "lessThan": "953d28a4f459fcbde2d08f51aeca19d6b0f179f3",
              "status": "affected",
              "version": "77e337c6e23e3b9d22e09ffec202a80f755a54c2",
              "versionType": "git"
            },
            {
              "lessThan": "0c49f12c77b77a706fd41370c11910635e491845",
              "status": "affected",
              "version": "77e337c6e23e3b9d22e09ffec202a80f755a54c2",
              "versionType": "git"
            },
            {
              "lessThan": "8e8f1ddf4186731649df8bc9646017369eb19186",
              "status": "affected",
              "version": "77e337c6e23e3b9d22e09ffec202a80f755a54c2",
              "versionType": "git"
            },
            {
              "lessThan": "2542a3f70e563a9e70e7ded314286535a3321bdb",
              "status": "affected",
              "version": "77e337c6e23e3b9d22e09ffec202a80f755a54c2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/thermal/intel/int340x_thermal/int3402_thermal.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.18"
            },
            {
              "lessThan": "3.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.292",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.236",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.180",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.292",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.236",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.180",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.134",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.87",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.23",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal: int340x: Add NULL check for adev\n\nNot all devices have an ACPI companion fwnode, so adev might be NULL.\nThis is similar to the commit cd2fd6eab480\n(\"platform/x86: int3472: Check for adev == NULL\").\n\nAdd a check for adev not being set and return -ENODEV in that case to\navoid a possible NULL pointer deref in int3402_thermal_probe().\n\nNote, under the same directory, int3400_thermal_probe() has such a\ncheck.\n\n[ rjw: Subject edit, added Fixes: ]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:13:39.845Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d0d21c8e44216fa9afdb3809edf213f3c0a8c060"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc7b5f782d28942dbdfda70df30ce132694a06de"
        },
        {
          "url": "https://git.kernel.org/stable/c/3155d5261b518776d1b807d9d922669991bbee56"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a810c462f099353e908c70619638884cb82229c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac2eb7378319e3836cdf3a2c15a0bdf04c50e81d"
        },
        {
          "url": "https://git.kernel.org/stable/c/953d28a4f459fcbde2d08f51aeca19d6b0f179f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c49f12c77b77a706fd41370c11910635e491845"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e8f1ddf4186731649df8bc9646017369eb19186"
        },
        {
          "url": "https://git.kernel.org/stable/c/2542a3f70e563a9e70e7ded314286535a3321bdb"
        }
      ],
      "title": "thermal: int340x: Add NULL check for adev",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-23136",
    "datePublished": "2025-04-16T14:13:16.439Z",
    "dateReserved": "2025-01-11T14:28:41.511Z",
    "dateUpdated": "2026-07-14T12:40:53.776Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:42:50.659Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bec8109f957a6e193e52d1728799994c8005ca83",
              "status": "affected",
              "version": "e3e3b3eb54feaf6400800812c8d0f95a7213923d",
              "versionType": "git"
            },
            {
              "lessThan": "1903a6c1f2818154f6bc87bceaaecafa92b6ac5c",
              "status": "affected",
              "version": "7a498fc945080bccc25fdc36f1d663798441158b",
              "versionType": "git"
            },
            {
              "lessThan": "a936be9b5f51c4d23f66fb673e9068c6b08104a4",
              "status": "affected",
              "version": "53173e3865acb06f3e86c703696510c12fecc612",
              "versionType": "git"
            },
            {
              "lessThan": "b356ee013a79e7e3147bfe065de376706c5d2ee9",
              "status": "affected",
              "version": "69505fe98f198ee813898cbcaf6770949636430b",
              "versionType": "git"
            },
            {
              "lessThan": "7ce6f83ca9d52c9245b7a017466fc4baa1241b0b",
              "status": "affected",
              "version": "69505fe98f198ee813898cbcaf6770949636430b",
              "versionType": "git"
            },
            {
              "lessThan": "bd20733746263acaaf2a21881665db27ee4303d5",
              "status": "affected",
              "version": "69505fe98f198ee813898cbcaf6770949636430b",
              "versionType": "git"
            },
            {
              "lessThan": "a49f0abd8959048af18c6c690b065eb0d65b2d21",
              "status": "affected",
              "version": "69505fe98f198ee813898cbcaf6770949636430b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d5ad80aabd5a76a5de52b7663b1f3223dd01ea38",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.190",
              "status": "affected",
              "version": "5.15.165",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.148",
              "status": "affected",
              "version": "6.1.103",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.102",
              "status": "affected",
              "version": "6.6.44",
              "versionType": "semver"
            },
            {
              "lessThan": "6.11",
              "status": "affected",
              "version": "6.10.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/file.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "5.15.165",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.148",
                  "versionStartIncluding": "6.1.103",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.102",
                  "versionStartIncluding": "6.6.44",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"fs/ntfs3: Replace inode_trylock with inode_lock\"\n\nThis reverts commit 69505fe98f198ee813898cbcaf6770949636430b.\n\nInitially, conditional lock acquisition was removed to fix an xfstest bug\nthat was observed during internal testing. The deadlock reported by syzbot\nis resolved by reintroducing conditional acquisition. The xfstest bug no\nlonger occurs on kernel version 6.16-rc1 during internal testing. I\nassume that changes in other modules may have contributed to this."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T16:00:36.146Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bec8109f957a6e193e52d1728799994c8005ca83"
        },
        {
          "url": "https://git.kernel.org/stable/c/1903a6c1f2818154f6bc87bceaaecafa92b6ac5c"
        },
        {
          "url": "https://git.kernel.org/stable/c/a936be9b5f51c4d23f66fb673e9068c6b08104a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/b356ee013a79e7e3147bfe065de376706c5d2ee9"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ce6f83ca9d52c9245b7a017466fc4baa1241b0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd20733746263acaaf2a21881665db27ee4303d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/a49f0abd8959048af18c6c690b065eb0d65b2d21"
        }
      ],
      "title": "Revert \"fs/ntfs3: Replace inode_trylock with inode_lock\"",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39734",
    "datePublished": "2025-09-07T15:16:22.015Z",
    "dateReserved": "2025-04-16T07:20:57.119Z",
    "dateUpdated": "2026-05-23T16:00:36.146Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/edac/i10nm_base.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8100b6c0f9089d5b156642b81270ce27fff17490",
              "status": "affected",
              "version": "ba987eaaabf99b462cdfed86274e3455d5126349",
              "versionType": "git"
            },
            {
              "lessThan": "1652f14cf3bef5a4baa232de954fc22bdcaa78fe",
              "status": "affected",
              "version": "ba987eaaabf99b462cdfed86274e3455d5126349",
              "versionType": "git"
            },
            {
              "lessThan": "c20da24272f1ac79e9f9083bba577d049cd02bbb",
              "status": "affected",
              "version": "ba987eaaabf99b462cdfed86274e3455d5126349",
              "versionType": "git"
            },
            {
              "lessThan": "2e6fe1bbefd9c059c3787d1c620fe67343a94dff",
              "status": "affected",
              "version": "ba987eaaabf99b462cdfed86274e3455d5126349",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/edac/i10nm_base.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.112",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.53",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.3",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nEDAC/i10nm: Skip DIMM enumeration on a disabled memory controller\n\nWhen loading the i10nm_edac driver on some Intel Granite Rapids servers,\na call trace may appear as follows:\n\n  UBSAN: shift-out-of-bounds in drivers/edac/skx_common.c:453:16\n  shift exponent -66 is negative\n  ...\n  __ubsan_handle_shift_out_of_bounds+0x1e3/0x390\n  skx_get_dimm_info.cold+0x47/0xd40 [skx_edac_common]\n  i10nm_get_dimm_config+0x23e/0x390 [i10nm_edac]\n  skx_register_mci+0x159/0x220 [skx_edac_common]\n  i10nm_init+0xcb0/0x1ff0 [i10nm_edac]\n  ...\n\nThis occurs because some BIOS may disable a memory controller if there\naren\u0027t any memory DIMMs populated on this memory controller. The DIMMMTR\nregister of this disabled memory controller contains the invalid value\n~0, resulting in the call trace above.\n\nFix this call trace by skipping DIMM enumeration on a disabled memory\ncontroller."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:43:50.466Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8100b6c0f9089d5b156642b81270ce27fff17490"
        },
        {
          "url": "https://git.kernel.org/stable/c/1652f14cf3bef5a4baa232de954fc22bdcaa78fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/c20da24272f1ac79e9f9083bba577d049cd02bbb"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e6fe1bbefd9c059c3787d1c620fe67343a94dff"
        }
      ],
      "title": "EDAC/i10nm: Skip DIMM enumeration on a disabled memory controller",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40157",
    "datePublished": "2025-11-12T10:23:29.258Z",
    "dateReserved": "2025-04-16T07:20:57.176Z",
    "dateUpdated": "2026-05-11T21:43:50.466Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:40:53.180Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/appletalk/aarp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b35694ffabb2af308a1f725d70f60fd8a47d1f3e",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "82d19a70ced28b17a38ebf1b6978c6c7db894979",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "186942d19c0222617ef61f50e1dba91e269a5963",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "2a6209e4649d45fd85d4193abc481911858ffc6f",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "e4f1564c5b699eb89b3040688fd6b4e57922f1f6",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "5f02ea0f63dd38c41539ea290fcc1693c73aa8e5",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "f90b6bb203f3f38bf2b3d976113d51571df9a482",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6c4a92d07b0850342d3becf2e608f805e972467c",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/appletalk/aarp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.41",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.148",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.101",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.41",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.9",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: appletalk: Fix use-after-free in AARP proxy probe\n\nThe AARP proxy\u2010probe routine (aarp_proxy_probe_network) sends a probe,\nreleases the aarp_lock, sleeps, then re-acquires the lock.  During that\nwindow an expire timer thread (__aarp_expire_timer) can remove and\nkfree() the same entry, leading to a use-after-free.\n\nrace condition:\n\n         cpu 0                          |            cpu 1\n    atalk_sendmsg()                     |   atif_proxy_probe_device()\n    aarp_send_ddp()                     |   aarp_proxy_probe_network()\n    mod_timer()                         |   lock(aarp_lock) // LOCK!!\n    timeout around 200ms                |   alloc(aarp_entry)\n    and then call                       |   proxies[hash] = aarp_entry\n    aarp_expire_timeout()               |   aarp_send_probe()\n                                        |   unlock(aarp_lock) // UNLOCK!!\n    lock(aarp_lock) // LOCK!!           |   msleep(100);\n    __aarp_expire_timer(\u0026proxies[ct])   |\n    free(aarp_entry)                    |\n    unlock(aarp_lock) // UNLOCK!!       |\n                                        |   lock(aarp_lock) // LOCK!!\n                                        |   UAF aarp_entry !!\n\n==================================================================\nBUG: KASAN: slab-use-after-free in aarp_proxy_probe_network+0x560/0x630 net/appletalk/aarp.c:493\nRead of size 4 at addr ffff8880123aa360 by task repro/13278\n\nCPU: 3 UID: 0 PID: 13278 Comm: repro Not tainted 6.15.2 #3 PREEMPT(full)\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x116/0x1b0 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:408 [inline]\n print_report+0xc1/0x630 mm/kasan/report.c:521\n kasan_report+0xca/0x100 mm/kasan/report.c:634\n aarp_proxy_probe_network+0x560/0x630 net/appletalk/aarp.c:493\n atif_proxy_probe_device net/appletalk/ddp.c:332 [inline]\n atif_ioctl+0xb58/0x16c0 net/appletalk/ddp.c:857\n atalk_ioctl+0x198/0x2f0 net/appletalk/ddp.c:1818\n sock_do_ioctl+0xdc/0x260 net/socket.c:1190\n sock_ioctl+0x239/0x6a0 net/socket.c:1311\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:906 [inline]\n __se_sys_ioctl fs/ioctl.c:892 [inline]\n __x64_sys_ioctl+0x194/0x200 fs/ioctl.c:892\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xcb/0x250 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e\n\nAllocated:\n aarp_alloc net/appletalk/aarp.c:382 [inline]\n aarp_proxy_probe_network+0xd8/0x630 net/appletalk/aarp.c:468\n atif_proxy_probe_device net/appletalk/ddp.c:332 [inline]\n atif_ioctl+0xb58/0x16c0 net/appletalk/ddp.c:857\n atalk_ioctl+0x198/0x2f0 net/appletalk/ddp.c:1818\n\nFreed:\n kfree+0x148/0x4d0 mm/slub.c:4841\n __aarp_expire net/appletalk/aarp.c:90 [inline]\n __aarp_expire_timer net/appletalk/aarp.c:261 [inline]\n aarp_expire_timeout+0x480/0x6e0 net/appletalk/aarp.c:317\n\nThe buggy address belongs to the object at ffff8880123aa300\n which belongs to the cache kmalloc-192 of size 192\nThe buggy address is located 96 bytes inside of\n freed 192-byte region [ffff8880123aa300, ffff8880123aa3c0)\n\nMemory state around the buggy address:\n ffff8880123aa200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffff8880123aa280: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc\n\u003effff8880123aa300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n                                                       ^\n ffff8880123aa380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc\n ffff8880123aa400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n=================================================================="
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:32:37.617Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b35694ffabb2af308a1f725d70f60fd8a47d1f3e"
        },
        {
          "url": "https://git.kernel.org/stable/c/82d19a70ced28b17a38ebf1b6978c6c7db894979"
        },
        {
          "url": "https://git.kernel.org/stable/c/186942d19c0222617ef61f50e1dba91e269a5963"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a6209e4649d45fd85d4193abc481911858ffc6f"
        },
        {
          "url": "https://git.kernel.org/stable/c/e4f1564c5b699eb89b3040688fd6b4e57922f1f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f02ea0f63dd38c41539ea290fcc1693c73aa8e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/f90b6bb203f3f38bf2b3d976113d51571df9a482"
        },
        {
          "url": "https://git.kernel.org/stable/c/6c4a92d07b0850342d3becf2e608f805e972467c"
        }
      ],
      "title": "net: appletalk: Fix use-after-free in AARP proxy probe",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38666",
    "datePublished": "2025-08-22T16:02:58.144Z",
    "dateReserved": "2025-04-16T04:51:24.031Z",
    "dateUpdated": "2026-05-11T21:32:37.617Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:38:03.697Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_flow_table.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a3aea97d55964e70a1e6426aa4cafdc036e8a2dd",
              "status": "affected",
              "version": "d06977b9a4109f8738bb276125eb6a0b772bc433",
              "versionType": "git"
            },
            {
              "lessThan": "eed8960b289327235185b7c32649c3470a3e969b",
              "status": "affected",
              "version": "8bf7c76a2a207ca2b4cfda0a279192adf27678d7",
              "versionType": "git"
            },
            {
              "lessThan": "9fbc49429a23b02595ba82536c5ea425fdabb221",
              "status": "affected",
              "version": "a2471d271042ea18e8a6babc132a8716bb2f08b9",
              "versionType": "git"
            },
            {
              "lessThan": "e0dd2e9729660f3f4fcb16e0aef87342911528ef",
              "status": "affected",
              "version": "87b3593bed1868b2d9fe096c01bcdf0ea86cbebf",
              "versionType": "git"
            },
            {
              "lessThan": "cfbf0665969af2c69d10c377d4c3d306e717efb4",
              "status": "affected",
              "version": "87b3593bed1868b2d9fe096c01bcdf0ea86cbebf",
              "versionType": "git"
            },
            {
              "lessThan": "18cdb3d982da8976b28d57691eb256ec5688fad2",
              "status": "affected",
              "version": "87b3593bed1868b2d9fe096c01bcdf0ea86cbebf",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cf366ee3bc1b7d1c76a882640ba3b3f8f1039163",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.189",
              "status": "affected",
              "version": "5.15.157",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.146",
              "status": "affected",
              "version": "6.1.88",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.99",
              "status": "affected",
              "version": "6.6.29",
              "versionType": "semver"
            },
            {
              "lessThan": "6.9",
              "status": "affected",
              "version": "6.8.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_flow_table.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.146",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.99",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.189",
                  "versionStartIncluding": "5.15.157",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.146",
                  "versionStartIncluding": "6.1.88",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.99",
                  "versionStartIncluding": "6.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.39",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.7",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.8.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()\n\nsyzbot found a potential access to uninit-value in nf_flow_pppoe_proto()\n\nBlamed commit forgot the Ethernet header.\n\nBUG: KMSAN: uninit-value in nf_flow_offload_inet_hook+0x7e4/0x940 net/netfilter/nf_flow_table_inet.c:27\n  nf_flow_offload_inet_hook+0x7e4/0x940 net/netfilter/nf_flow_table_inet.c:27\n  nf_hook_entry_hookfn include/linux/netfilter.h:157 [inline]\n  nf_hook_slow+0xe1/0x3d0 net/netfilter/core.c:623\n  nf_hook_ingress include/linux/netfilter_netdev.h:34 [inline]\n  nf_ingress net/core/dev.c:5742 [inline]\n  __netif_receive_skb_core+0x4aff/0x70c0 net/core/dev.c:5837\n  __netif_receive_skb_one_core net/core/dev.c:5975 [inline]\n  __netif_receive_skb+0xcc/0xac0 net/core/dev.c:6090\n  netif_receive_skb_internal net/core/dev.c:6176 [inline]\n  netif_receive_skb+0x57/0x630 net/core/dev.c:6235\n  tun_rx_batched+0x1df/0x980 drivers/net/tun.c:1485\n  tun_get_user+0x4ee0/0x6b40 drivers/net/tun.c:1938\n  tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1984\n  new_sync_write fs/read_write.c:593 [inline]\n  vfs_write+0xb4b/0x1580 fs/read_write.c:686\n  ksys_write fs/read_write.c:738 [inline]\n  __do_sys_write fs/read_write.c:749 [inline]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:59:44.778Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a3aea97d55964e70a1e6426aa4cafdc036e8a2dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/eed8960b289327235185b7c32649c3470a3e969b"
        },
        {
          "url": "https://git.kernel.org/stable/c/9fbc49429a23b02595ba82536c5ea425fdabb221"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0dd2e9729660f3f4fcb16e0aef87342911528ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfbf0665969af2c69d10c377d4c3d306e717efb4"
        },
        {
          "url": "https://git.kernel.org/stable/c/18cdb3d982da8976b28d57691eb256ec5688fad2"
        }
      ],
      "title": "netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38441",
    "datePublished": "2025-07-25T15:27:20.276Z",
    "dateReserved": "2025-04-16T04:51:24.016Z",
    "dateUpdated": "2026-05-23T15:59:44.778Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:40:40.962Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/tdls.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0c84204cf0bbe89e454a5caccc6a908bc7db1542",
              "status": "affected",
              "version": "81dd2b8822410e56048b927be779d95a2b6dc186",
              "versionType": "git"
            },
            {
              "lessThan": "378ae9ccaea3f445838a087962a067b5cb2e8577",
              "status": "affected",
              "version": "81dd2b8822410e56048b927be779d95a2b6dc186",
              "versionType": "git"
            },
            {
              "lessThan": "af72badd5ee423eb16f6ad7fe0a62f1b4252d848",
              "status": "affected",
              "version": "81dd2b8822410e56048b927be779d95a2b6dc186",
              "versionType": "git"
            },
            {
              "lessThan": "4df663d4c1ca386dcab2f743dfc9f0cc07aef73c",
              "status": "affected",
              "version": "81dd2b8822410e56048b927be779d95a2b6dc186",
              "versionType": "git"
            },
            {
              "lessThan": "31af06b574394530f68a4310c45ecbe2f68853c4",
              "status": "affected",
              "version": "81dd2b8822410e56048b927be779d95a2b6dc186",
              "versionType": "git"
            },
            {
              "lessThan": "16ecdab5446f15a61ec88eb0d23d25d009821db0",
              "status": "affected",
              "version": "81dd2b8822410e56048b927be779d95a2b6dc186",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/tdls.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.17"
            },
            {
              "lessThan": "3.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.148",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.102",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: reject TDLS operations when station is not associated\n\nsyzbot triggered a WARN in ieee80211_tdls_oper() by sending\nNL80211_TDLS_ENABLE_LINK immediately after NL80211_CMD_CONNECT,\nbefore association completed and without prior TDLS setup.\n\nThis left internal state like sdata-\u003eu.mgd.tdls_peer uninitialized,\nleading to a WARN_ON() in code paths that assumed it was valid.\n\nReject the operation early if not in station mode or not associated."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:32:12.399Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0c84204cf0bbe89e454a5caccc6a908bc7db1542"
        },
        {
          "url": "https://git.kernel.org/stable/c/378ae9ccaea3f445838a087962a067b5cb2e8577"
        },
        {
          "url": "https://git.kernel.org/stable/c/af72badd5ee423eb16f6ad7fe0a62f1b4252d848"
        },
        {
          "url": "https://git.kernel.org/stable/c/4df663d4c1ca386dcab2f743dfc9f0cc07aef73c"
        },
        {
          "url": "https://git.kernel.org/stable/c/31af06b574394530f68a4310c45ecbe2f68853c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/16ecdab5446f15a61ec88eb0d23d25d009821db0"
        }
      ],
      "title": "wifi: mac80211: reject TDLS operations when station is not associated",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38644",
    "datePublished": "2025-08-22T16:00:49.899Z",
    "dateReserved": "2025-04-16T04:51:24.030Z",
    "dateUpdated": "2026-05-11T21:32:12.399Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_dim.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7581afc051542e11ccf3ade68acd01b7fb1a3cde",
              "status": "affected",
              "version": "445a25f6e1a2f6a132b06af6ede4f3c9b5f9af68",
              "versionType": "git"
            },
            {
              "lessThan": "2bc6fb90486e42dd80e660ef7a40c02b2516c6d6",
              "status": "affected",
              "version": "445a25f6e1a2f6a132b06af6ede4f3c9b5f9af68",
              "versionType": "git"
            },
            {
              "lessThan": "eb41a264a3a576dc040ee37c3d9d6b7e2d9be968",
              "status": "affected",
              "version": "445a25f6e1a2f6a132b06af6ede4f3c9b5f9af68",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_dim.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.39",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.7",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix race between DIM disable and net_dim()\n\nThere\u0027s a race between disabling DIM and NAPI callbacks using the dim\npointer on the RQ or SQ.\n\nIf NAPI checks the DIM state bit and sees it still set, it assumes\n`rq-\u003edim` or `sq-\u003edim` is valid. But if DIM gets disabled right after\nthat check, the pointer might already be set to NULL, leading to a NULL\npointer dereference in net_dim().\n\nFix this by calling `synchronize_net()` before freeing the DIM context.\nThis ensures all in-progress NAPI callbacks are finished before the\npointer is cleared.\n\nKernel log:\n\nBUG: kernel NULL pointer dereference, address: 0000000000000000\n...\nRIP: 0010:net_dim+0x23/0x190\n...\nCall Trace:\n \u003cTASK\u003e\n ? __die+0x20/0x60\n ? page_fault_oops+0x150/0x3e0\n ? common_interrupt+0xf/0xa0\n ? sysvec_call_function_single+0xb/0x90\n ? exc_page_fault+0x74/0x130\n ? asm_exc_page_fault+0x22/0x30\n ? net_dim+0x23/0x190\n ? mlx5e_poll_ico_cq+0x41/0x6f0 [mlx5_core]\n ? sysvec_apic_timer_interrupt+0xb/0x90\n mlx5e_handle_rx_dim+0x92/0xd0 [mlx5_core]\n mlx5e_napi_poll+0x2cd/0xac0 [mlx5_core]\n ? mlx5e_poll_ico_cq+0xe5/0x6f0 [mlx5_core]\n busy_poll_stop+0xa2/0x200\n ? mlx5e_napi_poll+0x1d9/0xac0 [mlx5_core]\n ? mlx5e_trigger_irq+0x130/0x130 [mlx5_core]\n __napi_busy_loop+0x345/0x3b0\n ? sysvec_call_function_single+0xb/0x90\n ? asm_sysvec_call_function_single+0x16/0x20\n ? sysvec_apic_timer_interrupt+0xb/0x90\n ? pcpu_free_area+0x1e4/0x2e0\n napi_busy_loop+0x11/0x20\n xsk_recvmsg+0x10c/0x130\n sock_recvmsg+0x44/0x70\n __sys_recvfrom+0xbc/0x130\n ? __schedule+0x398/0x890\n __x64_sys_recvfrom+0x20/0x30\n do_syscall_64+0x4c/0x100\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n...\n---[ end trace 0000000000000000 ]---\n...\n---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is initiated through a local interface \u2014 the ethtool coalescing setter (SIOCETHTOOL/ETHTOOL_SCOALESCE or ethtool-netlink COALESCE_SET) toggling adaptive-rx/tx on an mlx5e netdev. Network traffic only drives the NAPI side; the triggering action requires local access to the device\u0027s netns.\nAC:L - The attacker controls both sides of the race \u2014 repeatedly enabling/disabling DIM while simultaneously keeping NAPI running via traffic or busy-poll recvmsg() \u2014 and can retry indefinitely at no cost. No condition beyond the attacker\u0027s influence is required.\nPR:L - The path requires CAP_NET_ADMIN only over the network namespace owning the netdev (`ns_capable(net-\u003euser_ns, CAP_NET_ADMIN)`), which an unprivileged user obtains in a user namespace (unshare -Urn) that holds an mlx5 netdev such as an SR-IOV VF assigned to a container.\nUI:N - The attacker performs both the ethtool toggle and the traffic generation; no action by any other user or administrator is needed.\nS:U - The corruption and crash are confined to the kernel of the affected host, with no crossing into a different security authority such as a hypervisor or IOMMU boundary.\nC:H - The freed `struct dim` can be dereferenced by in-flight NAPI after `kvfree()`, and a use-after-free on a heap-sprayable slab object lets an attacker overlap it with attacker-chosen data and leverage the resulting corruption for disclosure of kernel memory.\nI:H - `net_dim()` writes into the freed object (`dim-\u003estate`, `dim-\u003estart_sample`) and calls `schedule_work(\u0026dim-\u003ework)` on a freed `work_struct`, giving write and list-manipulation primitives against reclaimed memory that are exploitable for control-flow hijacking.\nA:H - The demonstrated result is a NULL pointer dereference inside `net_dim()` executing in interrupt context, producing \"Fatal exception in interrupt\" and a full kernel panic that the attacker can trigger repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:01:56.083Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7581afc051542e11ccf3ade68acd01b7fb1a3cde"
        },
        {
          "url": "https://git.kernel.org/stable/c/2bc6fb90486e42dd80e660ef7a40c02b2516c6d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/eb41a264a3a576dc040ee37c3d9d6b7e2d9be968"
        }
      ],
      "title": "net/mlx5e: Fix race between DIM disable and net_dim()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38440",
    "datePublished": "2025-07-25T15:27:19.447Z",
    "dateReserved": "2025-04-16T04:51:24.016Z",
    "dateUpdated": "2026-08-05T12:01:56.083Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:39:36.320Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-ids.h",
            "drivers/hid/hid-quirks.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "35f1a5360ac68d9629abbb3930a0a07901cba296",
              "status": "affected",
              "version": "83499b52c61f50292f0aae36499de8a8fc3e37c3",
              "versionType": "git"
            },
            {
              "lessThan": "7ac00f019698f614a49cce34c198d0568ab0e1c2",
              "status": "affected",
              "version": "83499b52c61f50292f0aae36499de8a8fc3e37c3",
              "versionType": "git"
            },
            {
              "lessThan": "1b297ab6f38ca60a4ca7298b297944ec6043b2f4",
              "status": "affected",
              "version": "83499b52c61f50292f0aae36499de8a8fc3e37c3",
              "versionType": "git"
            },
            {
              "lessThan": "2b0931eee48208c25bb77486946dea8e96aa6a36",
              "status": "affected",
              "version": "83499b52c61f50292f0aae36499de8a8fc3e37c3",
              "versionType": "git"
            },
            {
              "lessThan": "3ce1d87d1f5d80322757aa917182deb7370963b9",
              "status": "affected",
              "version": "83499b52c61f50292f0aae36499de8a8fc3e37c3",
              "versionType": "git"
            },
            {
              "lessThan": "c72536350e82b53a1be0f3bfdf1511bba2827102",
              "status": "affected",
              "version": "83499b52c61f50292f0aae36499de8a8fc3e37c3",
              "versionType": "git"
            },
            {
              "lessThan": "a2a91abd19c574b598b1c69ad76ad9c7eedaf062",
              "status": "affected",
              "version": "83499b52c61f50292f0aae36499de8a8fc3e37c3",
              "versionType": "git"
            },
            {
              "lessThan": "54bae4c17c11688339eb73a04fd24203bb6e7494",
              "status": "affected",
              "version": "83499b52c61f50292f0aae36499de8a8fc3e37c3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-ids.h",
            "drivers/hid/hid-quirks.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.8"
            },
            {
              "lessThan": "3.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.296",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.240",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.146",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.99",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.296",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.240",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.189",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.146",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.99",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.39",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.7",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras\n\nThe Chicony Electronics HP 5MP Cameras (USB ID 04F2:B824 \u0026 04F2:B82C)\nreport a HID sensor interface that is not actually implemented.\nAttempting to access this non-functional sensor via iio_info causes\nsystem hangs as runtime PM tries to wake up an unresponsive sensor.\n\nAdd these 2 devices to the HID ignore list since the sensor interface is\nnon-functional by design and should not be exposed to userspace."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:29:59.978Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/35f1a5360ac68d9629abbb3930a0a07901cba296"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ac00f019698f614a49cce34c198d0568ab0e1c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b297ab6f38ca60a4ca7298b297944ec6043b2f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b0931eee48208c25bb77486946dea8e96aa6a36"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ce1d87d1f5d80322757aa917182deb7370963b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/c72536350e82b53a1be0f3bfdf1511bba2827102"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2a91abd19c574b598b1c69ad76ad9c7eedaf062"
        },
        {
          "url": "https://git.kernel.org/stable/c/54bae4c17c11688339eb73a04fd24203bb6e7494"
        }
      ],
      "title": "HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38540",
    "datePublished": "2025-08-16T11:22:14.773Z",
    "dateReserved": "2025-04-16T04:51:24.024Z",
    "dateUpdated": "2026-05-11T21:29:59.978Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:39:01.805Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dd8e8314f2ce225dade5248dcfb9e2ac0edda624",
              "status": "affected",
              "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f",
              "versionType": "git"
            },
            {
              "lessThan": "40e25aa7e4e0f2440c73a683ee448e41c7c344ed",
              "status": "affected",
              "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f",
              "versionType": "git"
            },
            {
              "lessThan": "f10923b8d32a473b229477b63f23bbd72b1e9910",
              "status": "affected",
              "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f",
              "versionType": "git"
            },
            {
              "lessThan": "a62a895edb2bfebffa865b5129a66e3b4287f34f",
              "status": "affected",
              "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f",
              "versionType": "git"
            },
            {
              "lessThan": "0e5017d84d650ca0eeaf4a3fe9264c5dbc886b81",
              "status": "affected",
              "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f",
              "versionType": "git"
            },
            {
              "lessThan": "d18f63e848840100dbc351a82e7042eac5a28cf5",
              "status": "affected",
              "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f",
              "versionType": "git"
            },
            {
              "lessThan": "19d1314d46c0d8a5c08ab53ddeb62280c77698c0",
              "status": "affected",
              "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f",
              "versionType": "git"
            },
            {
              "lessThan": "c2ca42f190b6714d6c481dfd3d9b62ea091c946b",
              "status": "affected",
              "version": "4fa5a7f76cc7b6ac87f57741edd2b124851d119f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.15"
            },
            {
              "lessThan": "3.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.147",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.100",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.147",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.100",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.40",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.8",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: do not bypass hid_hw_raw_request\n\nhid_hw_raw_request() is actually useful to ensure the provided buffer\nand length are valid. Directly calling in the low level transport driver\nfunction bypassed those checks and allowed invalid paramto be used."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker supplies the malicious HID report descriptor through a local interface \u2014 `/dev/uhid` (UHID_CREATE2) \u2014 and triggers `hid_hw_request()` locally via device connect, an EV_LED write, or a force-feedback ioctl on `/dev/input/eventX`; no network or adjacent-network path is involved.\nAC:L - The attacker fully controls both the report descriptor that produces the degenerate `hid_report_len() == 0` value and the moment the request is issued, so the unvalidated length reaches the transport driver deterministically with no race or environmental precondition.\nPR:L - Only access to a HID char device is needed \u2014 `/dev/uhid` and `/dev/input/event*`/`hidraw` nodes are granted to the logged-in seat user via udev `uaccess` tagging on desktop and Android-class systems, and are routinely exposed inside privileged containers, so no real root in the initial namespace is required.\nUI:N - The attacker\u0027s own process creates the uhid device and issues the triggering request; `hidinput_change_resolution_multipliers()` fires the GET_REPORT automatically at device connect with no action from any other user.\nS:U - The corrupted memory and the bypassed validation are both inside the kernel\u0027s HID subsystem, managed by the same security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The unchecked `len == 0` causes a `size_t` underflow (`count--`) in transport handlers such as `i2c_hid_get_raw_report()` and `usbhid_get_raw_report()`, so an over-long response is copied out and then passed to `hid_input_report()` with an inflated size, exposing adjacent heap contents through input/hidraw data readable from userspace.\nI:H - The same underflow makes `i2c_hid_get_report()` memcpy up to `ihid-\u003ebufsize` bytes of device-controlled data into a 7-byte `hid_alloc_report_buf()` allocation \u2014 a controlled heap out-of-bounds write usable as a control-flow-hijack primitive; the patch additionally restores the bypassed HID-BPF request-filtering hook.\nA:H - Passing an invalid length into the low-level transport produces heap out-of-bounds reads and writes that reliably trigger KASAN reports, slab corruption, and kernel oops/panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:02:23.039Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dd8e8314f2ce225dade5248dcfb9e2ac0edda624"
        },
        {
          "url": "https://git.kernel.org/stable/c/40e25aa7e4e0f2440c73a683ee448e41c7c344ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/f10923b8d32a473b229477b63f23bbd72b1e9910"
        },
        {
          "url": "https://git.kernel.org/stable/c/a62a895edb2bfebffa865b5129a66e3b4287f34f"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e5017d84d650ca0eeaf4a3fe9264c5dbc886b81"
        },
        {
          "url": "https://git.kernel.org/stable/c/d18f63e848840100dbc351a82e7042eac5a28cf5"
        },
        {
          "url": "https://git.kernel.org/stable/c/19d1314d46c0d8a5c08ab53ddeb62280c77698c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2ca42f190b6714d6c481dfd3d9b62ea091c946b"
        }
      ],
      "title": "HID: core: do not bypass hid_hw_raw_request",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38494",
    "datePublished": "2025-07-28T11:22:03.180Z",
    "dateReserved": "2025-04-16T04:51:24.022Z",
    "dateUpdated": "2026-08-05T12:02:23.039Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_osnoise.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "823d798900481875ba6c68217af028c5ffd2976b",
              "status": "affected",
              "version": "e7186af7fb2609584a8bfb3da3c6ae09da5a5224",
              "versionType": "git"
            },
            {
              "lessThan": "7bb9ea515cda027c9e717e27fefcf34f092e7c41",
              "status": "affected",
              "version": "e7186af7fb2609584a8bfb3da3c6ae09da5a5224",
              "versionType": "git"
            },
            {
              "lessThan": "fbf90f5aa7ac7cddc69148a71d58f12c8709ce2b",
              "status": "affected",
              "version": "e7186af7fb2609584a8bfb3da3c6ae09da5a5224",
              "versionType": "git"
            },
            {
              "lessThan": "85a3bce695b361d85fc528e6fbb33e4c8089c806",
              "status": "affected",
              "version": "e7186af7fb2609584a8bfb3da3c6ae09da5a5224",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_osnoise.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.100",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.100",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.40",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.8",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/osnoise: Fix crash in timerlat_dump_stack()\n\nWe have observed kernel panics when using timerlat with stack saving,\nwith the following dmesg output:\n\nmemcpy: detected buffer overflow: 88 byte write of buffer size 0\nWARNING: CPU: 2 PID: 8153 at lib/string_helpers.c:1032 __fortify_report+0x55/0xa0\nCPU: 2 UID: 0 PID: 8153 Comm: timerlatu/2 Kdump: loaded Not tainted 6.15.3-200.fc42.x86_64 #1 PREEMPT(lazy)\nCall Trace:\n \u003cTASK\u003e\n ? trace_buffer_lock_reserve+0x2a/0x60\n __fortify_panic+0xd/0xf\n __timerlat_dump_stack.cold+0xd/0xd\n timerlat_dump_stack.part.0+0x47/0x80\n timerlat_fd_read+0x36d/0x390\n vfs_read+0xe2/0x390\n ? syscall_exit_to_user_mode+0x1d5/0x210\n ksys_read+0x73/0xe0\n do_syscall_64+0x7b/0x160\n ? exc_page_fault+0x7e/0x1a0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n__timerlat_dump_stack() constructs the ftrace stack entry like this:\n\nstruct stack_entry *entry;\n...\nmemcpy(\u0026entry-\u003ecaller, fstack-\u003ecalls, size);\nentry-\u003esize = fstack-\u003enr_entries;\n\nSince commit e7186af7fb26 (\"tracing: Add back FORTIFY_SOURCE logic to\nkernel_stack event structure\"), struct stack_entry marks its caller\nfield with __counted_by(size). At the time of the memcpy, entry-\u003esize\ncontains garbage from the ringbuffer, which under some circumstances is\nzero, triggering a kernel panic by buffer overflow.\n\nPopulate the size field before the memcpy so that the out-of-bounds\ncheck knows the correct size. This is analogous to\n__ftrace_trace_stack()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:29:05.077Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/823d798900481875ba6c68217af028c5ffd2976b"
        },
        {
          "url": "https://git.kernel.org/stable/c/7bb9ea515cda027c9e717e27fefcf34f092e7c41"
        },
        {
          "url": "https://git.kernel.org/stable/c/fbf90f5aa7ac7cddc69148a71d58f12c8709ce2b"
        },
        {
          "url": "https://git.kernel.org/stable/c/85a3bce695b361d85fc528e6fbb33e4c8089c806"
        }
      ],
      "title": "tracing/osnoise: Fix crash in timerlat_dump_stack()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38493",
    "datePublished": "2025-07-28T11:22:02.000Z",
    "dateReserved": "2025-04-16T04:51:24.022Z",
    "dateUpdated": "2026-05-11T21:29:05.077Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:39:43.796Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/mcast.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1b5b413094af8d88a31b5df3fd262f6baca53841",
              "status": "affected",
              "version": "b564ec4491d24b40900c64ab9e29a208f17f3108",
              "versionType": "git"
            },
            {
              "lessThan": "6e4eec86fe5f6b3fdbc702d1d36ac2a6e7ec0806",
              "status": "affected",
              "version": "63ed8de4be81b699ca727e9f8e3344bd487806d7",
              "versionType": "git"
            },
            {
              "lessThan": "728db00a14cacb37f36e9382ab5fad55caf890cc",
              "status": "affected",
              "version": "63ed8de4be81b699ca727e9f8e3344bd487806d7",
              "versionType": "git"
            },
            {
              "lessThan": "dcbc346f50a009d8b7f4e330f9f2e22d6442fa26",
              "status": "affected",
              "version": "63ed8de4be81b699ca727e9f8e3344bd487806d7",
              "versionType": "git"
            },
            {
              "lessThan": "7929d27c747eafe8fca3eecd74a334503ee4c839",
              "status": "affected",
              "version": "63ed8de4be81b699ca727e9f8e3344bd487806d7",
              "versionType": "git"
            },
            {
              "lessThan": "5f18e0130194550dff734e155029ae734378b5ea",
              "status": "affected",
              "version": "63ed8de4be81b699ca727e9f8e3344bd487806d7",
              "versionType": "git"
            },
            {
              "lessThan": "ae3264a25a4635531264728859dbe9c659fad554",
              "status": "affected",
              "version": "63ed8de4be81b699ca727e9f8e3344bd487806d7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/mcast.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.147",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.100",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.147",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.100",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.40",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.8",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: mcast: Delay put pmc-\u003eidev in mld_del_delrec()\n\npmc-\u003eidev is still used in ip6_mc_clear_src(), so as mld_clear_delrec()\ndoes, the reference should be put after ip6_mc_clear_src() return."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable `mld_del_delrec()` path is entered from IPv6 multicast socket options (`IPV6_ADD_MEMBERSHIP`/`MCAST_JOIN_GROUP`) via `ipv6_sock_mc_join()` \u2192 `__ipv6_dev_mc_inc()`, which requires a local socket and local syscall access. The secondary `ipv6_mc_up()` call site is likewise local (RTNL/admin), so no remote packet processing reaches this code directly.\nAC:L - The attacker deterministically creates the required state himself \u2014 join a group, drop it (creating the `mc_tomb` entry through `mld_add_delrec()` in the default MLDv2 mode), then rejoin \u2014 with no race to win and no memory-layout precondition outside his control. All steps are ordinary `setsockopt()` calls that succeed on the first try.\nPR:L - Only an unprivileged local account is needed; `ipv6_sock_mc_join()`/`ipv6_sock_mc_drop()` perform no capability check, and joining a global-scope IPv6 multicast group is permitted to any user holding an `AF_INET6` socket. No `CAP_NET_ADMIN` or root is required, and the path is equally available inside an unprivileged user namespace with a veth/dummy device.\nUI:N - The entire sequence is driven by the attacker\u0027s own socket calls in a single process. No victim action, no filesystem mount, and no administrator involvement is needed.\nS:U - The premature reference drop and its consequences are confined to the kernel\u0027s own `inet6_dev` allocation and the network namespace that owns it. No hypervisor, IOMMU, or sandbox boundary is crossed, so the vulnerable component and impacted component share one security authority.\nC:H - Dropping the `inet6_dev` reference before `ip6_mc_clear_src()` finishes using `pmc-\u003eidev` is a use-after-free pattern on a refcounted network structure; once the object can be reclaimed, an attacker who sprays the freed `inet6_dev` slab gains a read primitive over attacker-shaped heap contents and adjacent kernel data. Per the UAF guidance this warrants High rather than a bounded pointer leak.\nI:H - A use-after-free on `inet6_dev` gives the attacker control over the contents subsequently dereferenced through `pmc-\u003eidev`, including the `mc_lock`/list pointers reached from `mc_dereference()`, which is the standard basis for heap-spray-driven arbitrary write and control-flow hijack. Type-confused reuse of the freed slab makes kernel memory modification achievable rather than merely theoretical.\nA:H - If the released reference is the last one, the following `ip6_mc_clear_src()` operates on freed memory, producing an oops or panic and taking the whole kernel down. The trigger is a repeatable unprivileged `setsockopt()` loop, so the crash can be induced at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:02:49.916Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1b5b413094af8d88a31b5df3fd262f6baca53841"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e4eec86fe5f6b3fdbc702d1d36ac2a6e7ec0806"
        },
        {
          "url": "https://git.kernel.org/stable/c/728db00a14cacb37f36e9382ab5fad55caf890cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/dcbc346f50a009d8b7f4e330f9f2e22d6442fa26"
        },
        {
          "url": "https://git.kernel.org/stable/c/7929d27c747eafe8fca3eecd74a334503ee4c839"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f18e0130194550dff734e155029ae734378b5ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae3264a25a4635531264728859dbe9c659fad554"
        }
      ],
      "title": "ipv6: mcast: Delay put pmc-\u003eidev in mld_del_delrec()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38550",
    "datePublished": "2025-08-16T11:34:18.619Z",
    "dateReserved": "2025-04-16T04:51:24.024Z",
    "dateUpdated": "2026-08-05T12:02:49.916Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:28:57.581Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-53034",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:41:32.295522Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:13.457Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/ntb/hw/mscc/ntb_hw_switchtec.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f56951f211f181410a383d305e8d370993e45294",
              "status": "affected",
              "version": "1e2fd202f8593985cdadca32e0c322f98e7fe7cb",
              "versionType": "git"
            },
            {
              "lessThan": "5b6857bb3bfb0dae17fab1e42c1e82c204a508b1",
              "status": "affected",
              "version": "1e2fd202f8593985cdadca32e0c322f98e7fe7cb",
              "versionType": "git"
            },
            {
              "lessThan": "2429bdf26a0f3950fdd996861e9c1a3873af1dbe",
              "status": "affected",
              "version": "1e2fd202f8593985cdadca32e0c322f98e7fe7cb",
              "versionType": "git"
            },
            {
              "lessThan": "7ed22f8d8be26225a78cf5e85b2036421a6bf2d5",
              "status": "affected",
              "version": "1e2fd202f8593985cdadca32e0c322f98e7fe7cb",
              "versionType": "git"
            },
            {
              "lessThan": "c61a3f2df162ba424be0141649a9ef5f28eaccc1",
              "status": "affected",
              "version": "1e2fd202f8593985cdadca32e0c322f98e7fe7cb",
              "versionType": "git"
            },
            {
              "lessThan": "cb153bdc1812a3375639ed6ca5f147eaefb65349",
              "status": "affected",
              "version": "1e2fd202f8593985cdadca32e0c322f98e7fe7cb",
              "versionType": "git"
            },
            {
              "lessThan": "36d32cfb00d42e865396424bb5d340fc0a28870d",
              "status": "affected",
              "version": "1e2fd202f8593985cdadca32e0c322f98e7fe7cb",
              "versionType": "git"
            },
            {
              "lessThan": "0df2e03e4620548b41891b4e0d1bd9d2e0d8a39a",
              "status": "affected",
              "version": "1e2fd202f8593985cdadca32e0c322f98e7fe7cb",
              "versionType": "git"
            },
            {
              "lessThan": "de203da734fae00e75be50220ba5391e7beecdf9",
              "status": "affected",
              "version": "1e2fd202f8593985cdadca32e0c322f98e7fe7cb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/ntb/hw/mscc/ntb_hw_switchtec.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.292",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.236",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.180",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.292",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.236",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.180",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.134",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.87",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.23",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans\n\nThere is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and\nsize. This would make xlate_pos negative.\n\n[   23.734156] switchtec switchtec0: MW 0: part 0 addr 0x0000000000000000 size 0x0000000000000000\n[   23.734158] ================================================================================\n[   23.734172] UBSAN: shift-out-of-bounds in drivers/ntb/hw/mscc/ntb_hw_switchtec.c:293:7\n[   23.734418] shift exponent -1 is negative\n\nEnsuring xlate_pos is a positive or zero before BIT."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - In the highest reasonable Switchtec deployment, dual hosts share a PCIe NTB fabric; a peer link-down notifies ntb_transport, which calls ntb_free_mw \u2192 ntb_mw_clear_trans and hits the vulnerable path without needing local code execution on the victim.\nAC:L - Once ntb_transport has set up memory windows, bringing the NTB link down deterministically schedules link_cleanup and invokes clear_trans with addr=0/size=0; no race or uncontrolled layout is required.\nPR:N - A peer on the NTB fabric can force link-down and trigger cleanup without any account or capability on the victim host; local debugfs/module paths need root, but the peer path needs none.\nUI:N - Link-state handling and MW teardown run in kernel workqueues from the NTB event path; no separate victim user action is required after the NTB stack is in use.\nS:U - Impact stays in the local kernel/host authority; this is not a VM escape, IOMMU bypass, or other cross-boundary compromise.\nC:L - The undefined shift is used only inside IS_ALIGNED() and is not an out-of-bounds memory read; under the overestimate rule for UBSAN/UB shift faults, limited confidentiality impact is appropriate rather than None or High.\nI:N - The bad shift does not write kernel memory or reprogram windows with attacker-controlled data; on size==0 the function still takes the clear path, so there is no integrity/write primitive.\nA:H - UBSAN reports shift-out-of-bounds on this path, and with UBSAN_TRAP or panic_on_warn the fault becomes a kernel trap/panic, which is high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:12:28.373Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f56951f211f181410a383d305e8d370993e45294"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b6857bb3bfb0dae17fab1e42c1e82c204a508b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/2429bdf26a0f3950fdd996861e9c1a3873af1dbe"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ed22f8d8be26225a78cf5e85b2036421a6bf2d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/c61a3f2df162ba424be0141649a9ef5f28eaccc1"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb153bdc1812a3375639ed6ca5f147eaefb65349"
        },
        {
          "url": "https://git.kernel.org/stable/c/36d32cfb00d42e865396424bb5d340fc0a28870d"
        },
        {
          "url": "https://git.kernel.org/stable/c/0df2e03e4620548b41891b4e0d1bd9d2e0d8a39a"
        },
        {
          "url": "https://git.kernel.org/stable/c/de203da734fae00e75be50220ba5391e7beecdf9"
        }
      ],
      "title": "ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53034",
    "datePublished": "2025-04-16T14:11:41.985Z",
    "dateReserved": "2025-03-27T16:40:15.758Z",
    "dateUpdated": "2026-08-05T09:12:28.373Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:41:32.888Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/usb/usbnet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "95789c2f94fd29dce8759f9766baa333f749287c",
              "status": "affected",
              "version": "b80aacfea6e8d6ed6e430aa13922d6ccf044415a",
              "versionType": "git"
            },
            {
              "lessThan": "0f10f83acfd619e13c64d6705908dfd792f19544",
              "status": "affected",
              "version": "869caa8de8cb94514df704ccbe0b024fda4b9398",
              "versionType": "git"
            },
            {
              "lessThan": "acacd48a37b52fc95f621765762c04152b58d642",
              "status": "affected",
              "version": "1e44ee6cdd123d6cfe78b4a94e1572e23bbb58ce",
              "versionType": "git"
            },
            {
              "lessThan": "d689645cd1594ea1d13cb0c404f8ad1011353e0e",
              "status": "affected",
              "version": "04e906839a053f092ef53f4fb2d610983412b904",
              "versionType": "git"
            },
            {
              "lessThan": "0c30988588b28393e3e8873d5654f910e86391ba",
              "status": "affected",
              "version": "04e906839a053f092ef53f4fb2d610983412b904",
              "versionType": "git"
            },
            {
              "lessThan": "fd9ee3f0d6a53844f65efde581c91bbb0ff749ac",
              "status": "affected",
              "version": "04e906839a053f092ef53f4fb2d610983412b904",
              "versionType": "git"
            },
            {
              "lessThan": "51de3600093429e3b712e5f091d767babc5dd6df",
              "status": "affected",
              "version": "04e906839a053f092ef53f4fb2d610983412b904",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ca124236cd14e61610f56df9a8f81376a1ffe660",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "54671d731f4977fb3c0c26f2840655b5204e4437",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.180",
              "status": "affected",
              "version": "5.15.168",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.134",
              "status": "affected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.87",
              "status": "affected",
              "version": "6.6.54",
              "versionType": "semver"
            },
            {
              "lessThan": "6.11",
              "status": "affected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12",
              "status": "affected",
              "version": "6.11.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/usb/usbnet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.180",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.180",
                  "versionStartIncluding": "5.15.168",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.134",
                  "versionStartIncluding": "6.1.113",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.87",
                  "versionStartIncluding": "6.6.54",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.23",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.11.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbnet:fix NPE during rx_complete\n\nMissing usbnet_going_away Check in Critical Path.\nThe usb_submit_urb function lacks a usbnet_going_away\nvalidation, whereas __usbnet_queue_skb includes this check.\n\nThis inconsistency creates a race condition where:\nA URB request may succeed, but the corresponding SKB data\nfails to be queued.\n\nSubsequent processes:\n(e.g., rx_complete \u2192 defer_bh \u2192 __skb_unlink(skb, list))\nattempt to access skb-\u003enext, triggering a NULL pointer\ndereference (Kernel Panic)."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:57:45.410Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/95789c2f94fd29dce8759f9766baa333f749287c"
        },
        {
          "url": "https://git.kernel.org/stable/c/0f10f83acfd619e13c64d6705908dfd792f19544"
        },
        {
          "url": "https://git.kernel.org/stable/c/acacd48a37b52fc95f621765762c04152b58d642"
        },
        {
          "url": "https://git.kernel.org/stable/c/d689645cd1594ea1d13cb0c404f8ad1011353e0e"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c30988588b28393e3e8873d5654f910e86391ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd9ee3f0d6a53844f65efde581c91bbb0ff749ac"
        },
        {
          "url": "https://git.kernel.org/stable/c/51de3600093429e3b712e5f091d767babc5dd6df"
        }
      ],
      "title": "usbnet:fix NPE during rx_complete",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22050",
    "datePublished": "2025-04-16T14:12:08.954Z",
    "dateReserved": "2024-12-29T08:45:45.811Z",
    "dateUpdated": "2026-05-23T15:57:45.410Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-22041",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-21T14:57:34.523491Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-21T15:01:46.174Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:41:23.122Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/mgmt/user_session.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f0eb3f575138b816da74697bd506682574742fcd",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "a8a8ae303a8395cbac270b5b404d85df6ec788f8",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "ca042cc0e4f9e0d2c8f86dd67e4b22f30a516a9b",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "8ed0e9d2f410f63525afb8351181eea36c80bcf1",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "33cc29e221df7a3085ae413e8c26c4e81a151153",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "15a9605f8d69dc85005b1a00c31a050b8625e1aa",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/mgmt/user_session.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.134",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.87",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.23",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in ksmbd_sessions_deregister()\n\nIn multichannel mode, UAF issue can occur in session_deregister\nwhen the second channel sets up a session through the connection of\nthe first channel. session that is freed through the global session\ntable can be accessed again through -\u003esessions of connection."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "ksmbd multichannel UAF in ksmbd_sessions_deregister(). Session freed via global table remains accessible through connection\u0027s session xarray. Attacker controls both sides of the race by managing connection lifecycle."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:56:14.282Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f0eb3f575138b816da74697bd506682574742fcd"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8a8ae303a8395cbac270b5b404d85df6ec788f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/ca042cc0e4f9e0d2c8f86dd67e4b22f30a516a9b"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ed0e9d2f410f63525afb8351181eea36c80bcf1"
        },
        {
          "url": "https://git.kernel.org/stable/c/33cc29e221df7a3085ae413e8c26c4e81a151153"
        },
        {
          "url": "https://git.kernel.org/stable/c/15a9605f8d69dc85005b1a00c31a050b8625e1aa"
        }
      ],
      "title": "ksmbd: fix use-after-free in ksmbd_sessions_deregister()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22041",
    "datePublished": "2025-04-16T14:11:58.250Z",
    "dateReserved": "2024-12-29T08:45:45.809Z",
    "dateUpdated": "2026-08-05T11:56:14.282Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-22080",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T16:15:41.224860Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-190",
                "description": "CWE-190 Integer Overflow or Wraparound",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T16:15:44.922Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/ntfs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f6d44b1aa46d317e52c21fb9314cfb20dd69e7b0",
              "status": "affected",
              "version": "60ce8dfde03558bfc290cd915c60fa243ba2ae84",
              "versionType": "git"
            },
            {
              "lessThan": "201a2bdda13b619c4927700ffe47d387a30ced50",
              "status": "affected",
              "version": "60ce8dfde03558bfc290cd915c60fa243ba2ae84",
              "versionType": "git"
            },
            {
              "lessThan": "85615aa442830027923fc690390fa74d17b36ae1",
              "status": "affected",
              "version": "60ce8dfde03558bfc290cd915c60fa243ba2ae84",
              "versionType": "git"
            },
            {
              "lessThan": "b9982065b82b4177ba3a7a72ce18c84921f7494d",
              "status": "affected",
              "version": "60ce8dfde03558bfc290cd915c60fa243ba2ae84",
              "versionType": "git"
            },
            {
              "lessThan": "6bb81b94f7a9cba6bde9a905cef52a65317a8b04",
              "status": "affected",
              "version": "60ce8dfde03558bfc290cd915c60fa243ba2ae84",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/ntfs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.87",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.23",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Prevent integer overflow in hdr_first_de()\n\nThe \"de_off\" and \"used\" variables come from the disk so they both need to\ncheck.  The problem is that on 32bit systems if they\u0027re both greater than\nUINT_MAX - 16 then the check does work as intended because of an integer\noverflow."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only by presenting a crafted NTFS volume to the local kernel as a block device \u2014 a USB stick on an automounting kiosk/NAS/infotainment unit, or a loop/NBD-backed image mounted via udisks2 \u2014 driving mount(2) and the subsequent index walks in fs/ntfs3/index.c. No network protocol handler is involved, and physical access is not strictly required since loop and network-block-backed images work equally well.\nAC:L - Every input to the wrap \u2014 hdr-\u003ede_off, hdr-\u003eused, hdr-\u003etotal, the entry size fields, and the attribute-list layout that steers which header escapes index_hdr_check() \u2014 is an attacker-chosen byte in the image, so the corruption is deterministic with no race to win and no dependency on kernel memory layout the attacker cannot influence. The 32-bit size_t requirement is a property of the target the attacker selects, and ntfs3 automounting removable NTFS media on 32-bit ARM NAS boxes, media players, and embedded appliances is the driver\u0027s canonical deployment rather than a rare configuration.\nPR:N - The attacker needs no account or credential on the target \u2014 they only supply the malicious filesystem image, which is then mounted by root, by an automount daemon such as udisks2/systemd, or by a container/VM image-handling service acting on the attacker\u0027s data. Every privileged operation along the path is performed by the victim system on the attacker\u0027s behalf; where a local account does exist, desktop polkit loop-mount brokering provides the same reach at even lower cost.\nUI:N - On kiosks, NAS appliances, and infotainment systems that automount removable media, inserting the device triggers the mount with no human participation, and the index code runs unattended during mount itself via ntfs_security_init()\u0027s indx_init()/indx_find() on the $SDH/$SII trees rather than waiting for a subsequent file access. In the loop-device scenario the attacker performs the mount themselves, so no separate victim action is required either.\nS:U - The wrapped pointer arithmetic, out-of-bounds reads, and memmove/memcpy writes all occur in kernel heap memory within the same kernel security authority that hosts the vulnerable ntfs3 code. No VM, IOMMU, hypervisor, or sandbox boundary is crossed.\nC:H - The wrapped pointer makes hdr_first_de() return an NTFS_DE outside the index buffer, and because hdr_next_de()\u0027s bound check wraps identically with used near UINT_MAX, the entry walk proceeds past the allocation reading adjacent kernel heap as entry headers. Those bytes are consumed as file names, key_size, and MFT references and handed to userspace through ntfs_dir_emit()/dir_emit() during readdir, and steer de_get_vbn()-driven follow-on reads, making adjacent kernel memory directly observable.\nI:H - The same out-of-bounds entry pointer is passed to the mutation paths \u2014 hdr_insert_de() performs memmove(Add2Ptr(before, de_size), before, used - off) and memcpy(before, de, de_size) through it, hdr_delete_de() memmoves through it, and indx_delete_entry() applies le16_sub_cpu()/le32_sub_cpu() to fields at that address \u2014 yielding an out-of-bounds write of attacker-chosen bytes into kernel heap adjacent to the MFT-record or index-block allocation. Controlled heap overwrite of that form is a usable memory-corruption primitive for control-flow hijack, and the corrupted headers are additionally written back to disk by indx_write().\nA:H - Dereferencing and walking a pointer built from wrapped 32-bit arithmetic reads and writes past the kmalloc\u0027d index buffer, producing slab corruption and oops/panic (KASAN-class out-of-bounds), and the resulting nonsensical index geometry drives _ntfs_bad_inode()/-EINVAL error paths across the mounted volume. The fault occurs during mount or the first directory operation and can be reproduced on every mount attempt of the crafted image."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:56:35.647Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f6d44b1aa46d317e52c21fb9314cfb20dd69e7b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/201a2bdda13b619c4927700ffe47d387a30ced50"
        },
        {
          "url": "https://git.kernel.org/stable/c/85615aa442830027923fc690390fa74d17b36ae1"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9982065b82b4177ba3a7a72ce18c84921f7494d"
        },
        {
          "url": "https://git.kernel.org/stable/c/6bb81b94f7a9cba6bde9a905cef52a65317a8b04"
        }
      ],
      "title": "fs/ntfs3: Prevent integer overflow in hdr_first_de()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22080",
    "datePublished": "2025-04-16T14:12:29.886Z",
    "dateReserved": "2024-12-29T08:45:45.815Z",
    "dateUpdated": "2026-08-05T11:56:35.647Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-39809",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T18:14:35.149925Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T18:22:54.861Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-dev.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4adce86d4b13d15dec7810967839b931b1598700",
              "status": "affected",
              "version": "5282e45ccbfa91524944a32d40386c54fdd4d145",
              "versionType": "git"
            },
            {
              "lessThan": "1db9df89a213318a48d958385dc1b17b379dc32b",
              "status": "affected",
              "version": "5282e45ccbfa91524944a32d40386c54fdd4d145",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/intel-thc-hid/intel-quicki2c/quicki2c-dev.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.5",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: intel-thc-hid: intel-quicki2c: Fix ACPI dsd ICRS/ISUB length\n\nThe QuickI2C ACPI _DSD methods return ICRS and ISUB data with a\ntrailing byte, making the actual length is one more byte than the\nstructs defined.\n\nIt caused stack-out-of-bounds and kernel crash:\n\nkernel: BUG: KASAN: stack-out-of-bounds in quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c]\nkernel: Write of size 12 at addr ffff888106d1f900 by task kworker/u33:2/75\nkernel:\nkernel: CPU: 3 UID: 0 PID: 75 Comm: kworker/u33:2 Not tainted 6.16.0+ #3 PREEMPT(voluntary)\nkernel: Workqueue: async async_run_entry_fn\nkernel: Call Trace:\nkernel:  \u003cTASK\u003e\nkernel:  dump_stack_lvl+0x76/0xa0\nkernel:  print_report+0xd1/0x660\nkernel:  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\nkernel:  ? __kasan_slab_free+0x5d/0x80\nkernel:  ? kasan_addr_to_slab+0xd/0xb0\nkernel:  kasan_report+0xe1/0x120\nkernel:  ? quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c]\nkernel:  ? quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c]\nkernel:  kasan_check_range+0x11c/0x200\nkernel:  __asan_memcpy+0x3b/0x80\nkernel:  quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c]\nkernel:  ? __pfx_quicki2c_acpi_get_dsd_property.constprop.0+0x10/0x10 [intel_quicki2c]\nkernel:  quicki2c_get_acpi_resources+0x237/0x730 [intel_quicki2c]\n[...]\nkernel:  \u003c/TASK\u003e\nkernel:\nkernel: The buggy address belongs to stack of task kworker/u33:2/75\nkernel:  and is located at offset 48 in frame:\nkernel:  quicki2c_get_acpi_resources+0x0/0x730 [intel_quicki2c]\nkernel:\nkernel: This frame has 3 objects:\nkernel:  [32, 36) \u0027hid_desc_addr\u0027\nkernel:  [48, 59) \u0027i2c_param\u0027\nkernel:  [80, 224) \u0027i2c_config\u0027\n\nACPI DSD methods return:\n\n\\_SB.PC00.THC0.ICRS Buffer       000000003fdc947b 001 Len 0C = 0A 00 80 1A 06 00 00 00 00 00 00 00\n\\_SB.PC00.THC0.ISUB Buffer       00000000f2fcbdc4 001 Len 91 = 00 00 00 00 00 00 00 00 00 00 00 00\n\nAdding reserved padding to quicki2c_subip_acpi_parameter/config."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through local PCI driver probe of the Intel THC QuickI2C controller, consuming ACPI `_DSD` data from the local platform firmware namespace; there is no network or adjacent-network path to it.\nAC:L - The overflow is fully deterministic \u2014 every probe on affected hardware copies a firmware-returned buffer that is one byte larger than the destination stack struct, with no race, no memory-layout dependency, and no conditional configuration required.\nPR:N - The vulnerable memcpy executes unconditionally during automatic async device probe at boot, before any user authenticates; no capability, credential, or privileged operation is checked anywhere on the path from PCI enumeration to the overflow.\nUI:N - Probe is triggered by PCI device enumeration on the async probe workqueue with no user action whatsoever \u2014 no file to open, no device to attach, no mount to perform.\nS:U - The corruption is confined to the kernel stack within the same security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - An out-of-bounds write on the kernel stack adjacent to other frame locals, saved registers, and the return address is leveragable for control-flow manipulation and therefore arbitrary kernel memory disclosure, and the copy length is entirely unvalidated so the overwrite is not inherently bounded.\nI:H - This is a stack out-of-bounds write whose size comes unchecked from the ACPI buffer length, giving a write primitive past the destination object into the caller\u0027s frame \u2014 including canary and saved return address \u2014 which is the classic path to control-flow hijack.\nA:H - The bug is a confirmed KASAN stack-out-of-bounds that crashed the kernel on affected hardware, and stack corruption reliably produces a panic (stack-protector abort or corrupted return), rendering the machine unbootable at probe time."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:20.529Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4adce86d4b13d15dec7810967839b931b1598700"
        },
        {
          "url": "https://git.kernel.org/stable/c/1db9df89a213318a48d958385dc1b17b379dc32b"
        }
      ],
      "title": "HID: intel-thc-hid: intel-quicki2c: Fix ACPI dsd ICRS/ISUB length",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39809",
    "datePublished": "2025-09-16T13:00:11.977Z",
    "dateReserved": "2025-04-16T07:20:57.137Z",
    "dateUpdated": "2026-08-05T12:05:20.529Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:38:14.193Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:42:03.832Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "923a276c74e25073ae391e930792ac86a9f77f1e",
              "status": "affected",
              "version": "5e50da01d0ce7ef0ba3ed6cfabd62f327da0aca6",
              "versionType": "git"
            },
            {
              "lessThan": "90436e72c9622c2f70389070088325a3232d339f",
              "status": "affected",
              "version": "5e50da01d0ce7ef0ba3ed6cfabd62f327da0aca6",
              "versionType": "git"
            },
            {
              "lessThan": "25452638f133ac19d75af3f928327d8016952c8e",
              "status": "affected",
              "version": "5e50da01d0ce7ef0ba3ed6cfabd62f327da0aca6",
              "versionType": "git"
            },
            {
              "lessThan": "23c165dde88eac405eebb59051ea1fe139a45803",
              "status": "affected",
              "version": "5e50da01d0ce7ef0ba3ed6cfabd62f327da0aca6",
              "versionType": "git"
            },
            {
              "lessThan": "4c691d1b6b6dbd73f30ed9ee7da05f037b0c49af",
              "status": "affected",
              "version": "5e50da01d0ce7ef0ba3ed6cfabd62f327da0aca6",
              "versionType": "git"
            },
            {
              "lessThan": "8ecd651ef24ab50123692a4e3e25db93cb11602a",
              "status": "affected",
              "version": "5e50da01d0ce7ef0ba3ed6cfabd62f327da0aca6",
              "versionType": "git"
            },
            {
              "lessThan": "e28a383d6485c3bb51dc5953552f76c4dea33eea",
              "status": "affected",
              "version": "5e50da01d0ce7ef0ba3ed6cfabd62f327da0aca6",
              "versionType": "git"
            },
            {
              "lessThan": "ffdde7bf5a439aaa1955ebd581f5c64ab1533963",
              "status": "affected",
              "version": "5e50da01d0ce7ef0ba3ed6cfabd62f327da0aca6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_api.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.20"
            },
            {
              "lessThan": "2.6.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.296",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.240",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.146",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.99",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.296",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.240",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.189",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.146",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.99",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.39",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.7",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Abort __tc_modify_qdisc if parent class does not exist\n\nLion\u0027s patch [1] revealed an ancient bug in the qdisc API.\nWhenever a user creates/modifies a qdisc specifying as a parent another\nqdisc, the qdisc API will, during grafting, detect that the user is\nnot trying to attach to a class and reject. However grafting is\nperformed after qdisc_create (and thus the qdiscs\u0027 init callback) is\nexecuted. In qdiscs that eventually call qdisc_tree_reduce_backlog\nduring init or change (such as fq, hhf, choke, etc), an issue\narises. For example, executing the following commands:\n\nsudo tc qdisc add dev lo root handle a: htb default 2\nsudo tc qdisc add dev lo parent a: handle beef fq\n\nQdiscs such as fq, hhf, choke, etc unconditionally invoke\nqdisc_tree_reduce_backlog() in their control path init() or change() which\nthen causes a failure to find the child class; however, that does not stop\nthe unconditional invocation of the assumed child qdisc\u0027s qlen_notify with\na null class. All these qdiscs make the assumption that class is non-null.\n\nThe solution is ensure that qdisc_leaf() which looks up the parent\nclass, and is invoked prior to qdisc_create(), should return failure on\nnot finding the class.\nIn this patch, we leverage qdisc_leaf to return ERR_PTRs whenever the\nparentid doesn\u0027t correspond to a class, so that we can detect it\nearlier on and abort before qdisc_create is called.\n\n[1] https://lore.kernel.org/netdev/d912cbd7-193b-4269-9857-525bee8bbb6a@gmail.com/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:28:22.656Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/923a276c74e25073ae391e930792ac86a9f77f1e"
        },
        {
          "url": "https://git.kernel.org/stable/c/90436e72c9622c2f70389070088325a3232d339f"
        },
        {
          "url": "https://git.kernel.org/stable/c/25452638f133ac19d75af3f928327d8016952c8e"
        },
        {
          "url": "https://git.kernel.org/stable/c/23c165dde88eac405eebb59051ea1fe139a45803"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c691d1b6b6dbd73f30ed9ee7da05f037b0c49af"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ecd651ef24ab50123692a4e3e25db93cb11602a"
        },
        {
          "url": "https://git.kernel.org/stable/c/e28a383d6485c3bb51dc5953552f76c4dea33eea"
        },
        {
          "url": "https://git.kernel.org/stable/c/ffdde7bf5a439aaa1955ebd581f5c64ab1533963"
        }
      ],
      "title": "net/sched: Abort __tc_modify_qdisc if parent class does not exist",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38457",
    "datePublished": "2025-07-25T15:27:36.226Z",
    "dateReserved": "2025-04-16T04:51:24.019Z",
    "dateUpdated": "2026-07-14T12:42:03.832Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:10:11.398Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://github.com/keymaker-arch/KSMBDrain"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/09/15/2"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-38501",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-17T18:02:57.780485Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-30T14:34:03.682Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/connection.h",
            "fs/smb/server/transport_tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cb092fc3a62972a4aa47c9fe356c2c6a01cd840b",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "fa1c47af4ff641cf9197ecdb1f8240cbb30389c1",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "7e5d91d3e6c62a9755b36f29c35288f06c3cd86b",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "f1ce9258bcbce2491f9f71f7882b6eed0b33ec65",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "6073afe64510c302b7a0683a01e32c012eff715d",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "e6bb9193974059ddbb0ce7763fa3882bd60d4dc3",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/connection.h",
            "fs/smb/server/transport_tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.148",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.102",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: limit repeated connections from clients with the same IP\n\nRepeated connections from clients with the same IP address may exhaust\nthe max connections and prevent other normal client connections.\nThis patch limit repeated connections from clients with the same IP."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ksmbd is the in-kernel SMB server listening on TCP port 445, and the vulnerable accept path in `ksmbd_kthread_fn()` is driven entirely by inbound TCP connections from arbitrary remote hosts. Internet- and LAN-exposed file servers reach this code with no intermediate hop.\nAC:L - The attacker simply opens TCP connections in a loop and sends nothing; no race, no memory-layout dependency, and no state outside the attacker\u0027s control is involved. Because `ksmbd_tcp_readv()` is called with `max_retries = -1` and deadtime defaults to 0, the held connections are never reaped, making the attack fully deterministic and persistent.\nPR:N - Connection slots and per-connection kernel threads are allocated in `ksmbd_tcp_new_connection()` immediately after `kernel_accept()`, long before SMB NEGOTIATE or SESSION_SETUP \u2014 no credentials, share access, or SMB dialect negotiation is required. A completed TCP handshake is sufficient.\nUI:N - The attack is driven entirely by the remote attacker\u0027s own connections against the listening server socket. No action by an administrator, user, or legitimate SMB client is needed.\nS:U - The resource exhaustion is confined to the kernel\u0027s own connection slots, kthreads, and memory, all within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:N - The fix adds only per-IP connection accounting; there is no out-of-bounds read, uninitialized memory disclosure, or kernel pointer leak anywhere on the traced path. Nothing about the attacker\u0027s data is returned or exposed.\nI:N - No memory is corrupted and no data is modified \u2014 the flaw is missing admission control, not a write primitive. Server state and file data remain intact.\nA:H - A single unauthenticated remote host can consume all of `server_conf.max_connections` with silent, never-timing-out connections, completely denying SMB service to every other client; where `max_connections` is unset the pre-fix code has no cap at all, allowing unbounded kthread and kernel-memory allocation plus continuous busy-poll CPU burn, escalating to system-wide exhaustion."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:02:28.419Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cb092fc3a62972a4aa47c9fe356c2c6a01cd840b"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa1c47af4ff641cf9197ecdb1f8240cbb30389c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e5d91d3e6c62a9755b36f29c35288f06c3cd86b"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1ce9258bcbce2491f9f71f7882b6eed0b33ec65"
        },
        {
          "url": "https://git.kernel.org/stable/c/6073afe64510c302b7a0683a01e32c012eff715d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6bb9193974059ddbb0ce7763fa3882bd60d4dc3"
        }
      ],
      "title": "ksmbd: limit repeated connections from clients with the same IP",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38501",
    "datePublished": "2025-08-16T05:30:09.138Z",
    "dateReserved": "2025-04-16T04:51:24.022Z",
    "dateUpdated": "2026-08-05T12:02:28.419Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:40:13.723Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/ip6_fib.c",
            "net/ipv6/route.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6d345136c9b875f065d226908a29c25cdf9343f8",
              "status": "affected",
              "version": "d0ec61c9f3583b76aebdbb271f5c0d3fcccd48b2",
              "versionType": "git"
            },
            {
              "lessThan": "e1b7932af47f92432be8303d2439d1bf77b0be23",
              "status": "affected",
              "version": "52da02521ede55fb86546c3fffd9377b3261b91f",
              "versionType": "git"
            },
            {
              "lessThan": "cd8d8bbd9ced4cc5d06d858f67d4aa87745e8f38",
              "status": "affected",
              "version": "34a949e7a0869dfa31a40416d2a56973fae1807b",
              "versionType": "git"
            },
            {
              "lessThan": "3c13db3e47e170bab19e574404e7b6be45ea873d",
              "status": "affected",
              "version": "d9ccb18f83ea2bb654289b6ecf014fd267cc988b",
              "versionType": "git"
            },
            {
              "lessThan": "46aeb66e9e54ed0d56c18615e1c3dbd502b327ab",
              "status": "affected",
              "version": "d9ccb18f83ea2bb654289b6ecf014fd267cc988b",
              "versionType": "git"
            },
            {
              "lessThan": "54e6fe9dd3b0e7c481c2228782c9494d653546da",
              "status": "affected",
              "version": "d9ccb18f83ea2bb654289b6ecf014fd267cc988b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "11edcd026012ac18acee0f1514db3ed1b160fc6f",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.148",
              "status": "affected",
              "version": "6.1.128",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.102",
              "status": "affected",
              "version": "6.6.75",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.42",
              "status": "affected",
              "version": "6.12.2",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12",
              "status": "affected",
              "version": "6.11.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/ip6_fib.c",
            "net/ipv6/route.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.148",
                  "versionStartIncluding": "6.1.128",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.102",
                  "versionStartIncluding": "6.6.75",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "6.12.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.11.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: prevent infinite loop in rt6_nlmsg_size()\n\nWhile testing prior patch, I was able to trigger\nan infinite loop in rt6_nlmsg_size() in the following place:\n\nlist_for_each_entry_rcu(sibling, \u0026f6i-\u003efib6_siblings,\n\t\t\tfib6_siblings) {\n\trt6_nh_nlmsg_size(sibling-\u003efib6_nh, \u0026nexthop_len);\n}\n\nThis is because fib6_del_route() and fib6_add_rt2node()\nuses list_del_rcu(), which can confuse rcu readers,\nbecause they might no longer see the head of the list.\n\nRestart the loop if f6i-\u003efib6_nsiblings is zero."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T16:00:10.425Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6d345136c9b875f065d226908a29c25cdf9343f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1b7932af47f92432be8303d2439d1bf77b0be23"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd8d8bbd9ced4cc5d06d858f67d4aa87745e8f38"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c13db3e47e170bab19e574404e7b6be45ea873d"
        },
        {
          "url": "https://git.kernel.org/stable/c/46aeb66e9e54ed0d56c18615e1c3dbd502b327ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/54e6fe9dd3b0e7c481c2228782c9494d653546da"
        }
      ],
      "title": "ipv6: prevent infinite loop in rt6_nlmsg_size()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38588",
    "datePublished": "2025-08-19T17:03:09.856Z",
    "dateReserved": "2025-04-16T04:51:24.026Z",
    "dateUpdated": "2026-05-23T16:00:10.425Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:40:46.576Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/proc/generic.c",
            "fs/proc/inode.c",
            "fs/proc/internal.h",
            "include/linux/proc_fs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c35b0feb80b48720dfbbf4e33759c7be3faaebb6",
              "status": "affected",
              "version": "3f61631d47f115b83c935d0039f95cb68b0c8ab7",
              "versionType": "git"
            },
            {
              "lessThan": "33c778ea0bd0fa62ff590497e72562ff90f82b13",
              "status": "affected",
              "version": "3f61631d47f115b83c935d0039f95cb68b0c8ab7",
              "versionType": "git"
            },
            {
              "lessThan": "fc1072d934f687e1221d685cf1a49a5068318f34",
              "status": "affected",
              "version": "3f61631d47f115b83c935d0039f95cb68b0c8ab7",
              "versionType": "git"
            },
            {
              "lessThan": "d136502e04d8853a9aecb335d07bbefd7a1519a8",
              "status": "affected",
              "version": "3f61631d47f115b83c935d0039f95cb68b0c8ab7",
              "versionType": "git"
            },
            {
              "lessThan": "1fccbfbae1dd36198dc47feac696563244ad81d3",
              "status": "affected",
              "version": "3f61631d47f115b83c935d0039f95cb68b0c8ab7",
              "versionType": "git"
            },
            {
              "lessThan": "ff7ec8dc1b646296f8d94c39339e8d3833d16c05",
              "status": "affected",
              "version": "3f61631d47f115b83c935d0039f95cb68b0c8ab7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/proc/generic.c",
            "fs/proc/inode.c",
            "fs/proc/internal.h",
            "include/linux/proc_fs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.148",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.102",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nproc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al\n\nCheck pde-\u003eproc_ops-\u003eproc_lseek directly may cause UAF in rmmod scenario. \nIt\u0027s a gap in proc_reg_open() after commit 654b33ada4ab(\"proc: fix UAF in\nproc_get_inode()\").  Followed by AI Viro\u0027s suggestion, fix it in same\nmanner."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through the open(2) syscall on a procfs entry, requiring local access to the system. There is no network-facing path to proc_reg_open().\nAC:L - The attacker fully controls their side of the race and can spin unbounded threads on open(), while widening the lookup-to-open window with memory pressure since proc_get_inode() allocates GFP_KERNEL; on Android/embedded targets the module-teardown side is also reachable by toggling user-facing device state (WiFi/BT/camera), so the race can be provoked at will.\nPR:L - Any unprivileged local user can open a world-readable module-created /proc entry (e.g. /proc/net/*, /proc/scsi/*, /proc/driver/*); the unguarded dereference happens before any capability or use_pde() gate.\nUI:N - The attacker\u0027s own open() performs the faulty dereference; no victim needs to open a file, mount a filesystem, or otherwise interact.\nS:U - The use-after-free occurs in kernel memory and its impact stays within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free read of freed module memory through a dangling pde-\u003eproc_ops pointer, and freed-region contents that an attacker can groom (by triggering module loads that recycle the region) are consumed by the kernel and leak back through the resulting FMODE_LSEEK state.\nI:H - Use-after-free of a function-pointer table entry means kernel control-flow-relevant data is read from memory whose contents an attacker may influence via heap/module-region grooming, and such UAF conditions are treated as exploitable for corruption of kernel state.\nA:H - The dereference targets vmalloc-backed module memory that is unmapped on free, producing the same kernel page-fault oops documented in the companion fix 654b33ada4ab; the crash can be retriggered on every module unload."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:03:41.738Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c35b0feb80b48720dfbbf4e33759c7be3faaebb6"
        },
        {
          "url": "https://git.kernel.org/stable/c/33c778ea0bd0fa62ff590497e72562ff90f82b13"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc1072d934f687e1221d685cf1a49a5068318f34"
        },
        {
          "url": "https://git.kernel.org/stable/c/d136502e04d8853a9aecb335d07bbefd7a1519a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/1fccbfbae1dd36198dc47feac696563244ad81d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff7ec8dc1b646296f8d94c39339e8d3833d16c05"
        }
      ],
      "title": "proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38653",
    "datePublished": "2025-08-22T16:00:57.413Z",
    "dateReserved": "2025-04-16T04:51:24.030Z",
    "dateUpdated": "2026-08-05T12:03:41.738Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-apple.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ba08cc6801ec5fb98f2d02b5f0c614c931845325",
              "status": "affected",
              "version": "394ba612f9419ec5bfebbffb72212fd3b2094986",
              "versionType": "git"
            },
            {
              "lessThan": "7e15d1eaa88179c5185e57a38ab05fe852d0cb8d",
              "status": "affected",
              "version": "394ba612f9419ec5bfebbffb72212fd3b2094986",
              "versionType": "git"
            },
            {
              "lessThan": "00896c3f41cb6b74fec853386076115ba50baf0a",
              "status": "affected",
              "version": "394ba612f9419ec5bfebbffb72212fd3b2094986",
              "versionType": "git"
            },
            {
              "lessThan": "1bb3363da862e0464ec050eea2fb5472a36ad86b",
              "status": "affected",
              "version": "394ba612f9419ec5bfebbffb72212fd3b2094986",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-apple.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: apple: validate feature-report field count to prevent NULL pointer dereference\n\nA malicious HID device with quirk APPLE_MAGIC_BACKLIGHT can trigger a NULL\npointer dereference whilst the power feature-report is toggled and sent to\nthe device in apple_magic_backlight_report_set(). The power feature-report\nis expected to have two data fields, but if the descriptor declares one\nfield then accessing field[1] and dereferencing it in\napple_magic_backlight_report_set() becomes invalid\nsince field[1] will be NULL.\n\nAn example of a minimal descriptor which can cause the crash is something\nlike the following where the report with ID 3 (power report) only\nreferences a single 1-byte field. When hid core parses the descriptor it\nwill encounter the final feature tag, allocate a hid_report (all members\nof field[] will be zeroed out), create field structure and populate it,\nincreasing the maxfield to 1. The subsequent field[1] access and\ndereference causes the crash.\n\n  Usage Page (Vendor Defined 0xFF00)\n  Usage (0x0F)\n  Collection (Application)\n    Report ID (1)\n    Usage (0x01)\n    Logical Minimum (0)\n    Logical Maximum (255)\n    Report Size (8)\n    Report Count (1)\n    Feature (Data,Var,Abs)\n\n    Usage (0x02)\n    Logical Maximum (32767)\n    Report Size (16)\n    Report Count (1)\n    Feature (Data,Var,Abs)\n\n    Report ID (3)\n    Usage (0x03)\n    Logical Minimum (0)\n    Logical Maximum (1)\n    Report Size (8)\n    Report Count (1)\n    Feature (Data,Var,Abs)\n  End Collection\n\nHere we see the KASAN splat when the kernel dereferences the\nNULL pointer and crashes:\n\n  [   15.164723] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP KASAN NOPTI\n  [   15.165691] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]\n  [   15.165691] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.15.0 #31 PREEMPT(voluntary)\n  [   15.165691] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\n  [   15.165691] RIP: 0010:apple_magic_backlight_report_set+0xbf/0x210\n  [   15.165691] Call Trace:\n  [   15.165691]  \u003cTASK\u003e\n  [   15.165691]  apple_probe+0x571/0xa20\n  [   15.165691]  hid_device_probe+0x2e2/0x6f0\n  [   15.165691]  really_probe+0x1ca/0x5c0\n  [   15.165691]  __driver_probe_device+0x24f/0x310\n  [   15.165691]  driver_probe_device+0x4a/0xd0\n  [   15.165691]  __device_attach_driver+0x169/0x220\n  [   15.165691]  bus_for_each_drv+0x118/0x1b0\n  [   15.165691]  __device_attach+0x1d5/0x380\n  [   15.165691]  device_initial_probe+0x12/0x20\n  [   15.165691]  bus_probe_device+0x13d/0x180\n  [   15.165691]  device_add+0xd87/0x1510\n  [...]\n\nTo fix this issue we should validate the number of fields that the\nbacklight and power reports have and if they do not have the required\nnumber of fields then bail."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:30:23.955Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ba08cc6801ec5fb98f2d02b5f0c614c931845325"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e15d1eaa88179c5185e57a38ab05fe852d0cb8d"
        },
        {
          "url": "https://git.kernel.org/stable/c/00896c3f41cb6b74fec853386076115ba50baf0a"
        },
        {
          "url": "https://git.kernel.org/stable/c/1bb3363da862e0464ec050eea2fb5472a36ad86b"
        }
      ],
      "title": "HID: apple: validate feature-report field count to prevent NULL pointer dereference",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38557",
    "datePublished": "2025-08-19T17:02:35.641Z",
    "dateReserved": "2025-04-16T04:51:24.025Z",
    "dateUpdated": "2026-05-11T21:30:23.955Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/bluetooth/hci_core.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "86f3dcd1f331cfd4fd7ec88906955134ec51afbe",
              "status": "affected",
              "version": "ad383c2c65a5baf16e334cd40a013cc302176891",
              "versionType": "git"
            },
            {
              "lessThan": "7ce9bb0b95fc280e9212b8922590c492ca1d9c39",
              "status": "affected",
              "version": "ad383c2c65a5baf16e334cd40a013cc302176891",
              "versionType": "git"
            },
            {
              "lessThan": "16852eccbdfaf41a666705e3f8be55cf2864c5ca",
              "status": "affected",
              "version": "ad383c2c65a5baf16e334cd40a013cc302176891",
              "versionType": "git"
            },
            {
              "lessThan": "a351ff6b8ecca4229afaa0d98042bead8de64799",
              "status": "affected",
              "version": "ad383c2c65a5baf16e334cd40a013cc302176891",
              "versionType": "git"
            },
            {
              "lessThan": "f8069f34c4c976786ded97498012225af87435d7",
              "status": "affected",
              "version": "ad383c2c65a5baf16e334cd40a013cc302176891",
              "versionType": "git"
            },
            {
              "lessThan": "2935e556850e9c94d7a00adf14d3cd7fe406ac03",
              "status": "affected",
              "version": "ad383c2c65a5baf16e334cd40a013cc302176891",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/bluetooth/hci_core.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.159",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.117",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: fix double free in \u0027hci_discovery_filter_clear()\u0027\n\nFunction \u0027hci_discovery_filter_clear()\u0027 frees \u0027uuids\u0027 array and then\nsets it to NULL. There is a tiny chance of the following race:\n\n\u0027hci_cmd_sync_work()\u0027\n\n \u0027update_passive_scan_sync()\u0027\n\n   \u0027hci_update_passive_scan_sync()\u0027\n\n     \u0027hci_discovery_filter_clear()\u0027\n       kfree(uuids);\n\n       \u003c-------------------------preempted--------------------------------\u003e\n                                           \u0027start_service_discovery()\u0027\n\n                                             \u0027hci_discovery_filter_clear()\u0027\n                                               kfree(uuids); // DOUBLE FREE\n\n       \u003c-------------------------preempted--------------------------------\u003e\n\n      uuids = NULL;\n\nTo fix it let\u0027s add locking around \u0027kfree()\u0027 call and NULL pointer\nassignment. Otherwise the following backtrace fires:\n\n[ ] ------------[ cut here ]------------\n[ ] kernel BUG at mm/slub.c:547!\n[ ] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP\n[ ] CPU: 3 UID: 0 PID: 246 Comm: bluetoothd Tainted: G O 6.12.19-kernel #1\n[ ] Tainted: [O]=OOT_MODULE\n[ ] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ ] pc : __slab_free+0xf8/0x348\n[ ] lr : __slab_free+0x48/0x348\n...\n[ ] Call trace:\n[ ]  __slab_free+0xf8/0x348\n[ ]  kfree+0x164/0x27c\n[ ]  start_service_discovery+0x1d0/0x2c0\n[ ]  hci_sock_sendmsg+0x518/0x924\n[ ]  __sock_sendmsg+0x54/0x60\n[ ]  sock_write_iter+0x98/0xf8\n[ ]  do_iter_readv_writev+0xe4/0x1c8\n[ ]  vfs_writev+0x128/0x2b0\n[ ]  do_writev+0xfc/0x118\n[ ]  __arm64_sys_writev+0x20/0x2c\n[ ]  invoke_syscall+0x68/0xf0\n[ ]  el0_svc_common.constprop.0+0x40/0xe0\n[ ]  do_el0_svc+0x1c/0x28\n[ ]  el0_svc+0x30/0xd0\n[ ]  el0t_64_sync_handler+0x100/0x12c\n[ ]  el0t_64_sync+0x194/0x198\n[ ] Code: 8b0002e6 eb17031f 54fffbe1 d503201f (d4210000)\n[ ] ---[ end trace 0000000000000000 ]---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires issuing MGMT_OP_START_SERVICE_DISCOVERY/START_DISCOVERY on a local AF_BLUETOOTH HCI control socket via sendmsg/writev, so the attacker must have local system access. A remote/adjacent Bluetooth peer can only pump the workqueue side of the race (via LE connect/disconnect events), not the mgmt side, so local access is mandatory.\nAC:L - The attacker drives both sides of the race from the same socket \u2014 one thread loops START_SERVICE_DISCOVERY/STOP_DISCOVERY while another loops SET_SCAN_PARAMS/SET_DEVICE_FLAGS/adv-monitor ops to queue update_passive_scan_sync() \u2014 and the free paths take disjoint locks (hci_dev_lock vs hci_req_sync_lock), so the window is reachable and retryable indefinitely on a PREEMPT SMP kernel. The crash was in fact observed spontaneously in production with ordinary bluetoothd traffic.\nPR:L - The mgmt channel requires CAP_NET_ADMIN, but in the realistic Bluetooth deployments (Android\u0027s non-root AID_BLUETOOTH service, ChromeOS/embedded/automotive BT daemons) that capability is held by an unprivileged, SELinux-confined, remotely-reachable service process rather than by root, so a compromised Bluetooth daemon \u2014 far short of full admin \u2014 suffices to reach the bug.\nUI:N - No victim action is needed; the attacker\u0027s own threads issue every mgmt command required to open and hit the race window. No pairing, mount, or user-initiated scan is involved.\nS:U - The double free corrupts kernel heap metadata within the same kernel security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The double free of an attacker-sized (up to ~64 KB) and attacker-filled buffer corrupts the SLUB freelist and leaves a dangling hdev-\u003ediscovery.uuids that is still dereferenced by is_filter_match()/eir_has_uuids() on the advertisement RX path, yielding a use-after-free read that can be groomed into arbitrary kernel memory disclosure.\nI:H - A double free hands the same slab object to two owners, a classic primitive for cross-cache/overlapping-allocation attacks that convert into arbitrary kernel writes and control-flow hijack; the attacker fully controls the object\u0027s size class and contents, making the grooming practical.\nA:H - The reported, directly observed consequence is a kernel BUG() in __slab_free (mm/slub.c:547) taking down the machine, and freelist corruption reliably panics the kernel even when not weaponized further."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:03:15.011Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/86f3dcd1f331cfd4fd7ec88906955134ec51afbe"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ce9bb0b95fc280e9212b8922590c492ca1d9c39"
        },
        {
          "url": "https://git.kernel.org/stable/c/16852eccbdfaf41a666705e3f8be55cf2864c5ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/a351ff6b8ecca4229afaa0d98042bead8de64799"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8069f34c4c976786ded97498012225af87435d7"
        },
        {
          "url": "https://git.kernel.org/stable/c/2935e556850e9c94d7a00adf14d3cd7fe406ac03"
        }
      ],
      "title": "Bluetooth: hci_sync: fix double free in \u0027hci_discovery_filter_clear()\u0027",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38593",
    "datePublished": "2025-08-19T17:03:18.960Z",
    "dateReserved": "2025-04-16T04:51:24.028Z",
    "dateUpdated": "2026-08-05T12:03:15.011Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:42:13.673Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC CN 4100",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:06:08.852Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"
          }
        ],
        "x_adpType": "supplier"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-39682",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:42:07.158655Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:19.531Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2902c3ebcca52ca845c03182000e8d71d3a5196f",
              "status": "affected",
              "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
              "versionType": "git"
            },
            {
              "lessThan": "c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677",
              "status": "affected",
              "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
              "versionType": "git"
            },
            {
              "lessThan": "3439c15ae91a517cf3c650ea15a8987699416ad9",
              "status": "affected",
              "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
              "versionType": "git"
            },
            {
              "lessThan": "29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e",
              "status": "affected",
              "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
              "versionType": "git"
            },
            {
              "lessThan": "62708b9452f8eb77513115b17c4f8d1a22ebf843",
              "status": "affected",
              "version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.149",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.149",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.44",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.4",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix handling of zero-length records on the rx_list\n\nEach recvmsg() call must process either\n - only contiguous DATA records (any number of them)\n - one non-DATA record\n\nIf the next record has different type than what has already been\nprocessed we break out of the main processing loop. If the record\nhas already been decrypted (which may be the case for TLS 1.3 where\nwe don\u0027t know type until decryption) we queue the pending record\nto the rx_list. Next recvmsg() will pick it up from there.\n\nQueuing the skb to rx_list after zero-copy decrypt is not possible,\nsince in that case we decrypted directly to the user space buffer,\nand we don\u0027t have an skb to queue (darg.skb points to the ciphertext\nskb for access to metadata like length).\n\nOnly data records are allowed zero-copy, and we break the processing\nloop after each non-data record. So we should never zero-copy and\nthen find out that the record type has changed. The corner case\nwe missed is when the initial record comes from rx_list, and it\u0027s\nzero length."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is triggered entirely by the sequence and content of TLS records arriving from the remote peer on a kTLS-enabled TCP socket (net/tls RX path); no local access is needed. Any kTLS RX consumer \u2014 OpenSSL-with-kTLS servers/clients, NFS-over-TLS, SMB/RPC-over-TLS via net/handshake \u2014 is remotely reachable over the network.\nAC:L - The attacker sends three back-to-back records ([DATA][zero-length non-DATA][DATA]) and the corruption occurs deterministically on the victim\u0027s ordinary recvmsg() loop, with no race to win and no memory-layout dependency; the kernel selftest added with the fix reproduces it in one shot. TLS 1.2 is zero-copy-capable by default (zc_capable = rx_no_pad || version != TLS_1_3_VERSION), so no unusual kernel config or sockopt is required.\nPR:N - The attacker is the remote TLS peer, which holds no privileges on the target system \u2014 an anonymous client completing a server-authenticated TLS handshake with a kTLS server, or a malicious server that a kTLS client connects to, suffices. This matches the repo\u0027s PR:N scoring of the comparable remote-peer net/tls bug CVE-2025-39946.\nUI:N - The victim application only has to run its normal recvmsg() loop on an already-established kTLS socket; no click, mount, file open, or any other victim action is required. The attacker drives the entire trigger from the wire.\nS:U - The corruption is confined to kernel skb/slab state within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed. Standard in-kernel memory corruption is Scope:Unchanged.\nC:H - The strparser anchor is queued on rx_list after tcp_read_done() already released its backing TCP skbs, so the next recvmsg() copies freed kernel heap memory straight into the userspace buffer via skb_copy_datagram_msg(). This is a directly usable, repeatable kernel-memory disclosure primitive, not a bounded pointer leak.\nI:H - The live strp-\u003eanchor is consume_skb()\u0027d by process_rx_list() while the strparser still uses it, after which incoming attacker-controlled TCP data is written into the freed sk_buff/skb_shared_info (skb_fill_page_desc, tls_strp_load_anchor_with_queue), and socket teardown double-frees the anchor and its frag_list skbs. This yields attacker-controlled write-after-free and freelist corruption suitable for control-flow hijack.\nA:H - The use-after-free and double-free of the anchor and of already-released TCP receive-queue skbs reliably corrupt slab state, producing oopses/panics and list corruption. Any remote peer can repeat this on every connection, giving a trivial remote kernel-crash DoS."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:04:31.384Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2902c3ebcca52ca845c03182000e8d71d3a5196f"
        },
        {
          "url": "https://git.kernel.org/stable/c/c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677"
        },
        {
          "url": "https://git.kernel.org/stable/c/3439c15ae91a517cf3c650ea15a8987699416ad9"
        },
        {
          "url": "https://git.kernel.org/stable/c/29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e"
        },
        {
          "url": "https://git.kernel.org/stable/c/62708b9452f8eb77513115b17c4f8d1a22ebf843"
        }
      ],
      "title": "tls: fix handling of zero-length records on the rx_list",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39682",
    "datePublished": "2025-09-05T17:20:48.657Z",
    "dateReserved": "2025-04-16T07:20:57.113Z",
    "dateUpdated": "2026-08-05T12:04:31.384Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:41:45.338Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/sysctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "65ccb2793da7401772a3ffe85355c831b313c59f",
              "status": "affected",
              "version": "046c052b475e7119b6a30e3483e2888fc606a2f8",
              "versionType": "git"
            },
            {
              "lessThan": "386507cb6fb7cdef598ddcb3f0fa37e6ca9e789d",
              "status": "affected",
              "version": "046c052b475e7119b6a30e3483e2888fc606a2f8",
              "versionType": "git"
            },
            {
              "lessThan": "b3598f53211ba1025485306de2733bdd241311a3",
              "status": "affected",
              "version": "046c052b475e7119b6a30e3483e2888fc606a2f8",
              "versionType": "git"
            },
            {
              "lessThan": "e5178bfc55b3a78000f0f8298e7ade88783ce581",
              "status": "affected",
              "version": "046c052b475e7119b6a30e3483e2888fc606a2f8",
              "versionType": "git"
            },
            {
              "lessThan": "efb8cb487be8f4ba6aaef616011d702d6a083ed1",
              "status": "affected",
              "version": "046c052b475e7119b6a30e3483e2888fc606a2f8",
              "versionType": "git"
            },
            {
              "lessThan": "d3d7675d77622f6ca1aae14c51f80027b36283f8",
              "status": "affected",
              "version": "046c052b475e7119b6a30e3483e2888fc606a2f8",
              "versionType": "git"
            },
            {
              "lessThan": "10206302af856791fbcc27a33ed3c3eb09b2793d",
              "status": "affected",
              "version": "046c052b475e7119b6a30e3483e2888fc606a2f8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/sysctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.184",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.140",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.92",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.23",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: add mutual exclusion in proc_sctp_do_udp_port()\n\nWe must serialize calls to sctp_udp_sock_stop() and sctp_udp_sock_start()\nor risk a crash as syzbot reported:\n\nOops: general protection fault, probably for non-canonical address 0xdffffc000000000d: 0000 [#1] SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f]\nCPU: 1 UID: 0 PID: 6551 Comm: syz.1.44 Not tainted 6.14.0-syzkaller-g7f2ff7b62617 #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025\n RIP: 0010:kernel_sock_shutdown+0x47/0x70 net/socket.c:3653\nCall Trace:\n \u003cTASK\u003e\n  udp_tunnel_sock_release+0x68/0x80 net/ipv4/udp_tunnel_core.c:181\n  sctp_udp_sock_stop+0x71/0x160 net/sctp/protocol.c:930\n  proc_sctp_do_udp_port+0x264/0x450 net/sctp/sysctl.c:553\n  proc_sys_call_handler+0x3d0/0x5b0 fs/proc/proc_sysctl.c:601\n  iter_file_splice_write+0x91c/0x1150 fs/splice.c:738\n  do_splice_from fs/splice.c:935 [inline]\n  direct_splice_actor+0x18f/0x6c0 fs/splice.c:1158\n  splice_direct_to_actor+0x342/0xa30 fs/splice.c:1102\n  do_splice_direct_actor fs/splice.c:1201 [inline]\n  do_splice_direct+0x174/0x240 fs/splice.c:1227\n  do_sendfile+0xafd/0xe50 fs/read_write.c:1368\n  __do_sys_sendfile64 fs/read_write.c:1429 [inline]\n  __se_sys_sendfile64 fs/read_write.c:1415 [inline]\n  __x64_sys_sendfile64+0x1d8/0x220 fs/read_write.c:1415\n  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The only entry point is a write() (or sendfile()/splice()) to the procfs file /proc/sys/net/sctp/udp_port, handled by proc_sctp_do_udp_port(); no remote peer or network packet can reach this code path.\nAC:L - The attacker creates and controls both sides of the race by issuing two concurrent writes to the same sysctl, and the window spans udp_tunnel_sock_release()\u0027s synchronize_rcu() \u2014 a millisecond-scale gap between reading net-\u003esctp.udp4_sock and clearing it \u2014 making the double release trivially winnable.\nPR:L - The sysctl is per-netns and net_ctl_permissions() grants write access to CAP_NET_ADMIN in the netns\u0027s user_ns, which any unprivileged user obtains with `unshare -Urn`; the file is also owned by the ns root uid via net_ctl_set_ownership().\nUI:N - Exploitation is entirely self-contained in the attacker\u0027s own threads writing to a procfs file; no victim action or cooperation is required.\nS:U - The double free and subsequent memory corruption occur in kernel heap objects within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The unserialized sctp_udp_sock_stop() releases the same struct socket twice, producing a use-after-free/double-iput on the socket_alloc slab plus a sock_put() refcount underflow, letting the attacker reallocate the freed object and read back kernel memory contents.\nI:H - The second thread executes kernel_sock_shutdown(), which performs an indirect call via READ_ONCE(sock-\u003eops)-\u003eshutdown on the already-freed struct socket, giving a heap-spray-controlled function pointer and thus a control-flow hijack / arbitrary write primitive.\nA:H - The race reliably produces a kernel oops \u2014 syzbot reported a general protection fault (null-ptr-deref) in kernel_sock_shutdown() from sctp_udp_sock_stop() \u2014 and the double free/refcount underflow crashes or panics the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:56:28.212Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/65ccb2793da7401772a3ffe85355c831b313c59f"
        },
        {
          "url": "https://git.kernel.org/stable/c/386507cb6fb7cdef598ddcb3f0fa37e6ca9e789d"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3598f53211ba1025485306de2733bdd241311a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5178bfc55b3a78000f0f8298e7ade88783ce581"
        },
        {
          "url": "https://git.kernel.org/stable/c/efb8cb487be8f4ba6aaef616011d702d6a083ed1"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3d7675d77622f6ca1aae14c51f80027b36283f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/10206302af856791fbcc27a33ed3c3eb09b2793d"
        }
      ],
      "title": "sctp: add mutual exclusion in proc_sctp_do_udp_port()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22062",
    "datePublished": "2025-04-16T14:12:17.605Z",
    "dateReserved": "2024-12-29T08:45:45.813Z",
    "dateUpdated": "2026-08-05T11:56:28.212Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:41:59.218Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/alloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ef34840bda333fe99bafbd2d73b70ceaaf9eba66",
              "status": "affected",
              "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c",
              "versionType": "git"
            },
            {
              "lessThan": "538ed8b049ef801a86c543433e5061a91cc106e3",
              "status": "affected",
              "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c",
              "versionType": "git"
            },
            {
              "lessThan": "17c99ab3db2ba74096d36c69daa6e784e98fc0b8",
              "status": "affected",
              "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c",
              "versionType": "git"
            },
            {
              "lessThan": "11e24802e73362aa2948ee16b8fb4e32635d5b2a",
              "status": "affected",
              "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c",
              "versionType": "git"
            },
            {
              "lessThan": "3d012ba4404a0bb517658699ba85e6abda386dc3",
              "status": "affected",
              "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c",
              "versionType": "git"
            },
            {
              "lessThan": "49d2a2ea9d30991bae82107f9523915b91637683",
              "status": "affected",
              "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c",
              "versionType": "git"
            },
            {
              "lessThan": "b942f88fe7d2d789e51c5c30a675fa1c126f5a6d",
              "status": "affected",
              "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c",
              "versionType": "git"
            },
            {
              "lessThan": "e95d97c9c8cd0c239b7b59c79be0f6a9dcf7905c",
              "status": "affected",
              "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c",
              "versionType": "git"
            },
            {
              "lessThan": "a406aff8c05115119127c962cbbbbd202e1973ef",
              "status": "affected",
              "version": "ccd979bdbce9fba8412beb3f1de68a9d0171b12c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/alloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.16"
            },
            {
              "lessThan": "2.6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.292",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.236",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.180",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.292",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.236",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.180",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.134",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.87",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.23",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate l_tree_depth to avoid out-of-bounds access\n\nThe l_tree_depth field is 16-bit (__le16), but the actual maximum depth is\nlimited to OCFS2_MAX_PATH_DEPTH.\n\nAdd a check to prevent out-of-bounds access if l_tree_depth has an invalid\nvalue, which may occur when reading from a corrupted mounted disk [1]."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached by parsing on-disk OCFS2 extent-tree metadata of a mounted volume, requiring local access to supply/attach the crafted block device or to operate on files of the corrupted filesystem. It is not reachable via any network protocol handler.\nAC:L - The attacker fully controls the on-disk `l_tree_depth` fields and the extent-block chain, so the descent depth \u2014 and therefore the number of out-of-bounds `p_node[]` slots written \u2014 is deterministic; no race or uncontrollable precondition is involved (metaecc checksums are trivially computed by the attacker, and the feature may be off entirely).\nPR:L - An unprivileged local user suffices in realistic deployments: desktop/kiosk automounters (udisks2) mount attacker-supplied removable media, and on an already-mounted volume any user with file access drives `ocfs2_find_path()` via write/truncate/punch-hole/reflink. Real root in the initial namespace is not required for the trigger itself.\nUI:N - No separate victim action is needed \u2014 an automounter mounts the attacker\u0027s device automatically, and in OCFS2\u0027s native shared-disk cluster deployment the corrupted extent block is written to shared storage and consumed by peer nodes on an already-mounted filesystem during normal file I/O.\nS:U - The out-of-bounds write corrupts kernel slab memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The overflow writes kernel `buffer_head`/`ocfs2_extent_list` pointers into adjacent kmalloc-96 slab objects, corrupting neighbouring structures in a way that is leverageable into an arbitrary-read primitive and leaks kernel pointer values into adjacent state.\nI:H - This is an unbounded out-of-bounds heap write (a cyclic extent-block chain lets the index grow without limit), overwriting adjacent slab objects with kernel pointers \u2014 a classic heap-corruption primitive exploitable for control-flow hijack and privilege escalation.\nA:H - Corrupting neighbouring slab objects with pointer values reliably produces a kernel oops/panic, and the crafted chain can also loop indefinitely while scribbling over memory, taking the machine down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:56:34.590Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ef34840bda333fe99bafbd2d73b70ceaaf9eba66"
        },
        {
          "url": "https://git.kernel.org/stable/c/538ed8b049ef801a86c543433e5061a91cc106e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/17c99ab3db2ba74096d36c69daa6e784e98fc0b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/11e24802e73362aa2948ee16b8fb4e32635d5b2a"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d012ba4404a0bb517658699ba85e6abda386dc3"
        },
        {
          "url": "https://git.kernel.org/stable/c/49d2a2ea9d30991bae82107f9523915b91637683"
        },
        {
          "url": "https://git.kernel.org/stable/c/b942f88fe7d2d789e51c5c30a675fa1c126f5a6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e95d97c9c8cd0c239b7b59c79be0f6a9dcf7905c"
        },
        {
          "url": "https://git.kernel.org/stable/c/a406aff8c05115119127c962cbbbbd202e1973ef"
        }
      ],
      "title": "ocfs2: validate l_tree_depth to avoid out-of-bounds access",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-22079",
    "datePublished": "2025-04-16T14:12:29.215Z",
    "dateReserved": "2024-12-29T08:45:45.815Z",
    "dateUpdated": "2026-08-05T11:56:34.590Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath12k/dp_tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b508f370f88f277c95e2bd3bc47217a96d668cee",
              "status": "affected",
              "version": "e93bbd65547ea8073b707c9034c3f051f8018614",
              "versionType": "git"
            },
            {
              "lessThan": "ee4f8e7fa578f9f28cef5f409677db25f4f83d7e",
              "status": "affected",
              "version": "e93bbd65547ea8073b707c9034c3f051f8018614",
              "versionType": "git"
            },
            {
              "lessThan": "05062834350f0bf7ad1abcebc2807220e90220eb",
              "status": "affected",
              "version": "e93bbd65547ea8073b707c9034c3f051f8018614",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/ath/ath12k/dp_tx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type()\n\nIn ath12k_dp_tx_get_encap_type(), the arvif parameter is only used to\nretrieve the ab pointer. In vdev delete sequence the arvif-\u003ear could\nbecome NULL and that would trigger kernel panic.\nSince the caller ath12k_dp_tx() already has a valid ab pointer, pass it\ndirectly to avoid panic and unnecessary dereferencing.\n\nPC points to \"ath12k_dp_tx+0x228/0x988 [ath12k]\"\nLR points to \"ath12k_dp_tx+0xc8/0x988 [ath12k]\".\nThe Backtrace obtained is as follows:\nath12k_dp_tx+0x228/0x988 [ath12k]\nath12k_mac_tx_check_max_limit+0x608/0x920 [ath12k]\nieee80211_process_measurement_req+0x320/0x348 [mac80211]\nieee80211_tx_dequeue+0x9ac/0x1518 [mac80211]\nieee80211_tx_dequeue+0xb14/0x1518 [mac80211]\nieee80211_tx_prepare_skb+0x224/0x254 [mac80211]\nieee80211_xmit+0xec/0x100 [mac80211]\n__ieee80211_subif_start_xmit+0xc50/0xf40 [mac80211]\nieee80211_subif_start_xmit+0x2e8/0x308 [mac80211]\nnetdev_start_xmit+0x150/0x18c\ndev_hard_start_xmit+0x74/0xc0\n\nTested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:31:27.846Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b508f370f88f277c95e2bd3bc47217a96d668cee"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee4f8e7fa578f9f28cef5f409677db25f4f83d7e"
        },
        {
          "url": "https://git.kernel.org/stable/c/05062834350f0bf7ad1abcebc2807220e90220eb"
        }
      ],
      "title": "wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38605",
    "datePublished": "2025-08-19T17:03:49.295Z",
    "dateReserved": "2025-04-16T04:51:24.028Z",
    "dateUpdated": "2026-05-11T21:31:27.846Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-40114",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T14:47:06.245210Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-129",
                "description": "CWE-129 Improper Validation of Array Index",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T14:47:33.777Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/light/veml6075.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7a40b52d4442178bee0cf1c36bc450ab951cef0f",
              "status": "affected",
              "version": "3b82f43238aecd73464aeacc9c73407079511533",
              "versionType": "git"
            },
            {
              "lessThan": "18a08b5632809faa671279b3cd27d5f96cc5a3f0",
              "status": "affected",
              "version": "3b82f43238aecd73464aeacc9c73407079511533",
              "versionType": "git"
            },
            {
              "lessThan": "9c40a68b7f97fa487e6c7e67fcf4f846a1f96692",
              "status": "affected",
              "version": "3b82f43238aecd73464aeacc9c73407079511533",
              "versionType": "git"
            },
            {
              "lessThan": "ee735aa33db16c1fb5ebccbaf84ad38f5583f3cc",
              "status": "affected",
              "version": "3b82f43238aecd73464aeacc9c73407079511533",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/light/veml6075.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.23",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.11",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: light: Add check for array bounds in veml6075_read_int_time_ms\n\nThe array contains only 5 elements, but the index calculated by\nveml6075_read_int_time_index can range from 0 to 7,\nwhich could lead to out-of-bounds access. The check prevents this issue.\n\nCoverity Issue\nCID 1574309: (#1 of 1): Out-of-bounds read (OVERRUN)\noverrun-local: Overrunning array veml6075_it_ms of 5 4-byte\nelements at element index 7 (byte offset 31) using\nindex int_index (which evaluates to 7)\n\nThis is hardening against potentially broken hardware. Good to have\nbut not necessary to backport."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:42:55.223Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7a40b52d4442178bee0cf1c36bc450ab951cef0f"
        },
        {
          "url": "https://git.kernel.org/stable/c/18a08b5632809faa671279b3cd27d5f96cc5a3f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c40a68b7f97fa487e6c7e67fcf4f846a1f96692"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee735aa33db16c1fb5ebccbaf84ad38f5583f3cc"
        }
      ],
      "title": "iio: light: Add check for array bounds in veml6075_read_int_time_ms",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40114",
    "datePublished": "2025-04-18T07:01:40.964Z",
    "dateReserved": "2025-04-16T07:20:57.168Z",
    "dateUpdated": "2026-05-11T21:42:55.223Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:39:22.028Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/pinctrl/qcom/pinctrl-msm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6a89563ccf9cd0d745e2291302878a061508573f",
              "status": "affected",
              "version": "f365be0925729508fd8e62f8bdb504ef896cb6e0",
              "versionType": "git"
            },
            {
              "lessThan": "3f8fc02c2582c1dfad1785e9c7bc8b4e1521af0a",
              "status": "affected",
              "version": "f365be0925729508fd8e62f8bdb504ef896cb6e0",
              "versionType": "git"
            },
            {
              "lessThan": "cb4b08a095b1fa4b3fca782757517e4e9a917d8e",
              "status": "affected",
              "version": "f365be0925729508fd8e62f8bdb504ef896cb6e0",
              "versionType": "git"
            },
            {
              "lessThan": "cc145e02d6b8494c48f91958d52fa76b7e577f7b",
              "status": "affected",
              "version": "f365be0925729508fd8e62f8bdb504ef896cb6e0",
              "versionType": "git"
            },
            {
              "lessThan": "1d57f7132662e96aace3b8a000616efde289aae1",
              "status": "affected",
              "version": "f365be0925729508fd8e62f8bdb504ef896cb6e0",
              "versionType": "git"
            },
            {
              "lessThan": "275605a8b48002fe98675a5c06f3e39c09067ff2",
              "status": "affected",
              "version": "f365be0925729508fd8e62f8bdb504ef896cb6e0",
              "versionType": "git"
            },
            {
              "lessThan": "97c9c7daeeb00c6e1d5e84084041f79c2d2dce22",
              "status": "affected",
              "version": "f365be0925729508fd8e62f8bdb504ef896cb6e0",
              "versionType": "git"
            },
            {
              "lessThan": "93712205ce2f1fb047739494c0399a26ea4f0890",
              "status": "affected",
              "version": "f365be0925729508fd8e62f8bdb504ef896cb6e0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/pinctrl/qcom/pinctrl-msm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.14"
            },
            {
              "lessThan": "3.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.296",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.240",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.146",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.99",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.16",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.296",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.240",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.189",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.146",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.99",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.39",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.7",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: qcom: msm: mark certain pins as invalid for interrupts\n\nOn some platforms, the UFS-reset pin has no interrupt logic in TLMM but\nis nevertheless registered as a GPIO in the kernel. This enables the\nuser-space to trigger a BUG() in the pinctrl-msm driver by running, for\nexample: `gpiomon -c 0 113` on RB2.\n\nThe exact culprit is requesting pins whose intr_detection_width setting\nis not 1 or 2 for interrupts. This hits a BUG() in\nmsm_gpio_irq_set_type(). Potentially crashing the kernel due to an\ninvalid request from user-space is not optimal, so let\u0027s go through the\npins and mark those that would fail the check as invalid for the irq chip\nas we should not even register them as available irqs.\n\nThis function can be extended if we determine that there are more\ncorner-cases like this."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:29:31.861Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6a89563ccf9cd0d745e2291302878a061508573f"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f8fc02c2582c1dfad1785e9c7bc8b4e1521af0a"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb4b08a095b1fa4b3fca782757517e4e9a917d8e"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc145e02d6b8494c48f91958d52fa76b7e577f7b"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d57f7132662e96aace3b8a000616efde289aae1"
        },
        {
          "url": "https://git.kernel.org/stable/c/275605a8b48002fe98675a5c06f3e39c09067ff2"
        },
        {
          "url": "https://git.kernel.org/stable/c/97c9c7daeeb00c6e1d5e84084041f79c2d2dce22"
        },
        {
          "url": "https://git.kernel.org/stable/c/93712205ce2f1fb047739494c0399a26ea4f0890"
        }
      ],
      "title": "pinctrl: qcom: msm: mark certain pins as invalid for interrupts",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38516",
    "datePublished": "2025-08-16T10:55:03.161Z",
    "dateReserved": "2025-04-16T04:51:24.023Z",
    "dateUpdated": "2026-05-11T21:29:31.861Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:40:38.124Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/clk/davinci/psc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "77e9ad7a2d0e2a771c9e0be04b9d1639413b5f13",
              "status": "affected",
              "version": "c6ed4d734bc7f731709dab0ffd69eed499dd5277",
              "versionType": "git"
            },
            {
              "lessThan": "7843412e5927dafbb844782c56b6380564064109",
              "status": "affected",
              "version": "c6ed4d734bc7f731709dab0ffd69eed499dd5277",
              "versionType": "git"
            },
            {
              "lessThan": "2adc945b70c4d97e9491a6c0c9f3b217a9eecfba",
              "status": "affected",
              "version": "c6ed4d734bc7f731709dab0ffd69eed499dd5277",
              "versionType": "git"
            },
            {
              "lessThan": "105e8115944a9f93e9412abe7bb07ed96725adf9",
              "status": "affected",
              "version": "c6ed4d734bc7f731709dab0ffd69eed499dd5277",
              "versionType": "git"
            },
            {
              "lessThan": "1d92608a29251278015f57f3572bc950db7519f0",
              "status": "affected",
              "version": "c6ed4d734bc7f731709dab0ffd69eed499dd5277",
              "versionType": "git"
            },
            {
              "lessThan": "7943ed1f05f5cb7372dca2aa227f848747a98791",
              "status": "affected",
              "version": "c6ed4d734bc7f731709dab0ffd69eed499dd5277",
              "versionType": "git"
            },
            {
              "lessThan": "6fb19cdcf040e1dec052a9032acb66cc2ad1d43f",
              "status": "affected",
              "version": "c6ed4d734bc7f731709dab0ffd69eed499dd5277",
              "versionType": "git"
            },
            {
              "lessThan": "23f564326deaafacfd7adf6104755b15216d8320",
              "status": "affected",
              "version": "c6ed4d734bc7f731709dab0ffd69eed499dd5277",
              "versionType": "git"
            },
            {
              "lessThan": "13de464f445d42738fe18c9a28bab056ba3a290a",
              "status": "affected",
              "version": "c6ed4d734bc7f731709dab0ffd69eed499dd5277",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/clk/davinci/psc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.297",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.241",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.15.*",
              "status": "unaffected",
              "version": "6.15.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.297",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.241",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.190",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.148",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.102",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.42",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15.10",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: davinci: Add NULL check in davinci_lpsc_clk_register()\n\ndevm_kasprintf() returns NULL when memory allocation fails. Currently,\ndavinci_lpsc_clk_register() does not check for this case, which results\nin a NULL pointer dereference.\n\nAdd NULL check after devm_kasprintf() to prevent this issue and ensuring\nno resources are left allocated."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:32:02.059Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/77e9ad7a2d0e2a771c9e0be04b9d1639413b5f13"
        },
        {
          "url": "https://git.kernel.org/stable/c/7843412e5927dafbb844782c56b6380564064109"
        },
        {
          "url": "https://git.kernel.org/stable/c/2adc945b70c4d97e9491a6c0c9f3b217a9eecfba"
        },
        {
          "url": "https://git.kernel.org/stable/c/105e8115944a9f93e9412abe7bb07ed96725adf9"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d92608a29251278015f57f3572bc950db7519f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/7943ed1f05f5cb7372dca2aa227f848747a98791"
        },
        {
          "url": "https://git.kernel.org/stable/c/6fb19cdcf040e1dec052a9032acb66cc2ad1d43f"
        },
        {
          "url": "https://git.kernel.org/stable/c/23f564326deaafacfd7adf6104755b15216d8320"
        },
        {
          "url": "https://git.kernel.org/stable/c/13de464f445d42738fe18c9a28bab056ba3a290a"
        }
      ],
      "title": "clk: davinci: Add NULL check in davinci_lpsc_clk_register()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38635",
    "datePublished": "2025-08-22T16:00:43.181Z",
    "dateReserved": "2025-04-16T04:51:24.030Z",
    "dateUpdated": "2026-05-11T21:32:02.059Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}