{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/bcache/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "81f44ed8c3f54abb7561ece774ea4cca5070b2f2",
              "status": "affected",
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "versionType": "git"
            },
            {
              "lessThan": "f50e7c325ab1207fe941555bcff659f6d7050572",
              "status": "affected",
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "versionType": "git"
            },
            {
              "lessThan": "9467d360be70e6ee55b0c1cd2a1f1424f57b5b85",
              "status": "affected",
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "versionType": "git"
            },
            {
              "lessThan": "47fa09fe7f3e09df28a51cb2cbd8f5d2f7f6edc1",
              "status": "affected",
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "versionType": "git"
            },
            {
              "lessThan": "add4982510f3b7c318a2dd7438bdc9c63171e753",
              "status": "affected",
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "versionType": "git"
            },
            {
              "lessThan": "2d6965581e164fa2ba3f7652ddae5535f6336576",
              "status": "affected",
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "versionType": "git"
            },
            {
              "lessThan": "4f71c8ba2dc009042493021d94a9718fbe2ebf27",
              "status": "affected",
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "versionType": "git"
            },
            {
              "lessThan": "383f7fec0de8cee1cf7ae1f9d9f14044a61f10f9",
              "status": "affected",
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "versionType": "git"
            },
            {
              "lessThan": "fec114a98b8735ee89c75216c45a78e28be0f128",
              "status": "affected",
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/bcache/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.10"
            },
            {
              "lessThan": "3.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.136",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.83",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.24",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.14",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.1",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbcache: fix cached_dev.sb_bio use-after-free and crash\n\nIn our production environment, we have received multiple crash reports\nregarding libceph, which have caught our attention:\n\n```\n[6888366.280350] Call Trace:\n[6888366.280452]  blk_update_request+0x14e/0x370\n[6888366.280561]  blk_mq_end_request+0x1a/0x130\n[6888366.280671]  rbd_img_handle_request+0x1a0/0x1b0 [rbd]\n[6888366.280792]  rbd_obj_handle_request+0x32/0x40 [rbd]\n[6888366.280903]  __complete_request+0x22/0x70 [libceph]\n[6888366.281032]  osd_dispatch+0x15e/0xb40 [libceph]\n[6888366.281164]  ? inet_recvmsg+0x5b/0xd0\n[6888366.281272]  ? ceph_tcp_recvmsg+0x6f/0xa0 [libceph]\n[6888366.281405]  ceph_con_process_message+0x79/0x140 [libceph]\n[6888366.281534]  ceph_con_v1_try_read+0x5d7/0xf30 [libceph]\n[6888366.281661]  ceph_con_workfn+0x329/0x680 [libceph]\n```\n\nAfter analyzing the coredump file, we found that the address of\ndc-\u003esb_bio has been freed. We know that cached_dev is only freed when it\nis stopped.\n\nSince sb_bio is a part of struct cached_dev, rather than an alloc every\ntime.  If the device is stopped while writing to the superblock, the\nreleased address will be accessed at endio.\n\nThis patch hopes to wait for sb_write to complete in cached_dev_free.\n\nIt should be noted that we analyzed the cause of the problem, then tell\nall details to the QWEN and adopted the modifications it made."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-14T17:42:06.405Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/81f44ed8c3f54abb7561ece774ea4cca5070b2f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/f50e7c325ab1207fe941555bcff659f6d7050572"
        },
        {
          "url": "https://git.kernel.org/stable/c/9467d360be70e6ee55b0c1cd2a1f1424f57b5b85"
        },
        {
          "url": "https://git.kernel.org/stable/c/47fa09fe7f3e09df28a51cb2cbd8f5d2f7f6edc1"
        },
        {
          "url": "https://git.kernel.org/stable/c/add4982510f3b7c318a2dd7438bdc9c63171e753"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d6965581e164fa2ba3f7652ddae5535f6336576"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f71c8ba2dc009042493021d94a9718fbe2ebf27"
        },
        {
          "url": "https://git.kernel.org/stable/c/383f7fec0de8cee1cf7ae1f9d9f14044a61f10f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/fec114a98b8735ee89c75216c45a78e28be0f128"
        }
      ],
      "title": "bcache: fix cached_dev.sb_bio use-after-free and crash",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31580",
    "datePublished": "2026-04-24T14:42:10.874Z",
    "dateReserved": "2026-03-09T15:48:24.119Z",
    "dateUpdated": "2026-06-14T17:42:06.405Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kernel/proton-pack.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "598c11dd4f4a9de31d854fcb9702f54c1c70f0d0",
              "status": "affected",
              "version": "e192c8baa69ac8a5585d61ac535aa1e5eb795e80",
              "versionType": "git"
            },
            {
              "lessThan": "a8d0ad5d990b050a6db74218a34b5529085e16b8",
              "status": "affected",
              "version": "4bbfd0c280254b273c564767021bb9b0f945148e",
              "versionType": "git"
            },
            {
              "lessThan": "cccf96c49f61e47d9332d6a4d1c7fe9a2df44440",
              "status": "affected",
              "version": "558c303c9734af5a813739cd284879227f7297d2",
              "versionType": "git"
            },
            {
              "lessThan": "fd7e360845d331f542854d552469544182e61134",
              "status": "affected",
              "version": "558c303c9734af5a813739cd284879227f7297d2",
              "versionType": "git"
            },
            {
              "lessThan": "5dbe1f14359735fa50ba0dd4a496125b5bc7f422",
              "status": "affected",
              "version": "558c303c9734af5a813739cd284879227f7297d2",
              "versionType": "git"
            },
            {
              "lessThan": "fd51d47fcacec3ca027eb65d8c44853d3b6cea95",
              "status": "affected",
              "version": "558c303c9734af5a813739cd284879227f7297d2",
              "versionType": "git"
            },
            {
              "lessThan": "ad0c356cae164ed5dbd1f4cfd438e46faa5292cb",
              "status": "affected",
              "version": "558c303c9734af5a813739cd284879227f7297d2",
              "versionType": "git"
            },
            {
              "lessThan": "e3baa5d4b361276efeb87b20d8beced451a7dbd5",
              "status": "affected",
              "version": "558c303c9734af5a813739cd284879227f7297d2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4dd8aae585a51a1d276911fe19096ad90144e9fe",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3e3904125fccd042fda24294624e8f66699fd06d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c20d551744797000c4af993f7d59ef8c69732949",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9013fd4bc958b33c3b4d5a2eaf4ded9857600395",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0b2bf1b37b5ebd90e69e30d8c2d6e1cd0c1f37b4",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.252",
              "status": "affected",
              "version": "5.10.105",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.202",
              "status": "affected",
              "version": "5.15.28",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.310",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.275",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.236",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.186",
              "versionType": "semver"
            },
            {
              "lessThan": "5.17",
              "status": "affected",
              "version": "5.16.14",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kernel/proton-pack.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.252",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.252",
                  "versionStartIncluding": "5.10.105",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "5.15.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.310",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.275",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.236",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.186",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.16.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: Add support for TSV110 Spectre-BHB mitigation\n\nThe TSV110 processor is vulnerable to the Spectre-BHB (Branch History\nBuffer) attack, which can be exploited to leak information through\nbranch prediction side channels. This commit adds the MIDR of TSV110\nto the list for software mitigation."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T16:06:36.101Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/598c11dd4f4a9de31d854fcb9702f54c1c70f0d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8d0ad5d990b050a6db74218a34b5529085e16b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/cccf96c49f61e47d9332d6a4d1c7fe9a2df44440"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd7e360845d331f542854d552469544182e61134"
        },
        {
          "url": "https://git.kernel.org/stable/c/5dbe1f14359735fa50ba0dd4a496125b5bc7f422"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd51d47fcacec3ca027eb65d8c44853d3b6cea95"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad0c356cae164ed5dbd1f4cfd438e46faa5292cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3baa5d4b361276efeb87b20d8beced451a7dbd5"
        }
      ],
      "title": "arm64: Add support for TSV110 Spectre-BHB mitigation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43261",
    "datePublished": "2026-05-06T11:28:48.823Z",
    "dateReserved": "2026-05-01T14:12:55.997Z",
    "dateUpdated": "2026-05-23T16:06:36.101Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/seg6_iptunnel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1dec91d3b1cefb82635761b7812154af3ef46449",
              "status": "affected",
              "version": "6c8702c60b88651072460f3f4026c7dfe2521d12",
              "versionType": "git"
            },
            {
              "lessThan": "750569d6987a0ff46317a4b86eb3907e296287bf",
              "status": "affected",
              "version": "6c8702c60b88651072460f3f4026c7dfe2521d12",
              "versionType": "git"
            },
            {
              "lessThan": "57d0374d14fa667dec6952173b93e7e84486d5c9",
              "status": "affected",
              "version": "6c8702c60b88651072460f3f4026c7dfe2521d12",
              "versionType": "git"
            },
            {
              "lessThan": "84d458018b147176b259347103fccb7e93abd2b1",
              "status": "affected",
              "version": "6c8702c60b88651072460f3f4026c7dfe2521d12",
              "versionType": "git"
            },
            {
              "lessThan": "6305ad032b03d2ea4181b953a66e19a9a6ed053c",
              "status": "affected",
              "version": "6c8702c60b88651072460f3f4026c7dfe2521d12",
              "versionType": "git"
            },
            {
              "lessThan": "fb56de5d99218de49d5d43ef3a99e062ecd0f9a1",
              "status": "affected",
              "version": "6c8702c60b88651072460f3f4026c7dfe2521d12",
              "versionType": "git"
            },
            {
              "lessThan": "17d87d42874f5d6c1a0ccc6d9190dfe82a9a7a6a",
              "status": "affected",
              "version": "6c8702c60b88651072460f3f4026c7dfe2521d12",
              "versionType": "git"
            },
            {
              "lessThan": "c3812651b522fe8437ebb7063b75ddb95b571643",
              "status": "affected",
              "version": "6c8702c60b88651072460f3f4026c7dfe2521d12",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/seg6_iptunnel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.10"
            },
            {
              "lessThan": "4.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.169",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.135",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.82",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.23",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.169",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.135",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.82",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.23",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.13",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nseg6: separate dst_cache for input and output paths in seg6 lwtunnel\n\nThe seg6 lwtunnel uses a single dst_cache per encap route, shared\nbetween seg6_input_core() and seg6_output_core(). These two paths\ncan perform the post-encap SID lookup in different routing contexts\n(e.g., ip rules matching on the ingress interface, or VRF table\nseparation). Whichever path runs first populates the cache, and the\nother reuses it blindly, bypassing its own lookup.\n\nFix this by splitting the cache into cache_input and cache_output,\nso each path maintains its own cached dst independently."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable SRv6 lwtunnel input path is reachable by IPv6 packets forwarded through a configured SRv6 router, and those packets can populate the shared cache used by the other path. This is network-reachable in a reasonable SRv6 routing deployment.\nAC:L - The bug is deterministic cache reuse after one path populates the per-CPU dst_cache; an attacker can repeat traffic and influence ordering rather than win an uncontrolled race. The required differing routing contexts are normal SRv6 policy/VRF configurations.\nPR:N - Attacking an already configured SRv6 router does not require credentials or local privileges; unauthenticated network traffic can exercise the forwarding path. Route creation itself requires CAP_NET_ADMIN, but that is deployment setup rather than an attacker privilege requirement for the network attack.\nUI:N - No victim user action is required once the affected SRv6 route and policy rules are present. Packets alone drive the vulnerable lwtunnel paths.\nS:U - The impact remains within the Linux kernel/router routing authority and does not cross a hypervisor, IOMMU, or comparable security authority boundary. It is a routing policy bypass rather than a separate-scope escape.\nC:H - By reusing a dst computed in the wrong routing context, traffic can bypass VRF, rule, or blackhole isolation and reach protected networks or services. In a multi-tenant or segmented deployment this can expose data intended to be unreachable.\nI:H - The same policy bypass can allow unauthorized packets into protected routing domains or destinations, enabling modification or interaction with systems that routing policy was supposed to isolate. This is a broad network access-control bypass in the affected SRv6 path.\nA:H - Bypassing blackhole or VRF separation can allow repeated unwanted traffic to protected destinations or links that should have been dropped. In a reasonable router or DDoS-mitigation deployment this can defeat availability protections for the protected network."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:24:18.220Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1dec91d3b1cefb82635761b7812154af3ef46449"
        },
        {
          "url": "https://git.kernel.org/stable/c/750569d6987a0ff46317a4b86eb3907e296287bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/57d0374d14fa667dec6952173b93e7e84486d5c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/84d458018b147176b259347103fccb7e93abd2b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/6305ad032b03d2ea4181b953a66e19a9a6ed053c"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb56de5d99218de49d5d43ef3a99e062ecd0f9a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/17d87d42874f5d6c1a0ccc6d9190dfe82a9a7a6a"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3812651b522fe8437ebb7063b75ddb95b571643"
        }
      ],
      "title": "seg6: separate dst_cache for input and output paths in seg6 lwtunnel",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31668",
    "datePublished": "2026-04-24T14:45:16.630Z",
    "dateReserved": "2026-03-09T15:48:24.129Z",
    "dateUpdated": "2026-08-05T12:24:18.220Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/char/tpm/tpm-chip.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dd3ac52ea7a001406c7dbc663aae4b9f89da679a",
              "status": "affected",
              "version": "699e3efd6c645c741ea4d6d58282c56b6d108cf7",
              "versionType": "git"
            },
            {
              "lessThan": "53e6d2d834df40960b655b353e7a8ff4d927e1c7",
              "status": "affected",
              "version": "699e3efd6c645c741ea4d6d58282c56b6d108cf7",
              "versionType": "git"
            },
            {
              "lessThan": "84ced03172da544c9f8c0862faad48104f519352",
              "status": "affected",
              "version": "699e3efd6c645c741ea4d6d58282c56b6d108cf7",
              "versionType": "git"
            },
            {
              "lessThan": "c424d2664f08c77f08b4580b5f0cbaabf7c229b2",
              "status": "affected",
              "version": "699e3efd6c645c741ea4d6d58282c56b6d108cf7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/char/tpm/tpm-chip.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.86",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: Use kfree_sensitive() to free auth session in tpm_dev_release()\n\ntpm_dev_release() uses plain kfree() to free chip-\u003eauth, which contains\nsensitive cryptographic material including HMAC session keys, nonces,\nand passphrase data (struct tpm2_auth).\n\nEvery other code path that frees this structure uses kfree_sensitive()\nto zero the memory before releasing it: both tpm2_end_auth_session()\nand tpm_buf_check_hmac_response() do so. The tpm_dev_release() path\nis the only one that does not, leaving key material in freed slab\nmemory until it is eventually overwritten.\n\nUse kfree_sensitive() for consistency with the rest of the driver and\nto ensure session keys are scrubbed during device teardown."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-14T18:06:13.398Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dd3ac52ea7a001406c7dbc663aae4b9f89da679a"
        },
        {
          "url": "https://git.kernel.org/stable/c/53e6d2d834df40960b655b353e7a8ff4d927e1c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/84ced03172da544c9f8c0862faad48104f519352"
        },
        {
          "url": "https://git.kernel.org/stable/c/c424d2664f08c77f08b4580b5f0cbaabf7c229b2"
        }
      ],
      "title": "tpm: Use kfree_sensitive() to free auth session in tpm_dev_release()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46283",
    "datePublished": "2026-06-08T15:41:26.425Z",
    "dateReserved": "2026-05-13T15:03:33.110Z",
    "dateUpdated": "2026-06-14T18:06:13.398Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi-cadence-quadspi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8ce3ebbe5c718940b4e94f5c25f5720223f893f8",
              "status": "affected",
              "version": "a314f6367787ee1d767df9a2120f17e4511144d0",
              "versionType": "git"
            },
            {
              "lessThan": "56787f4a75907ae99b5f5842b756fa68e2482f6d",
              "status": "affected",
              "version": "a314f6367787ee1d767df9a2120f17e4511144d0",
              "versionType": "git"
            },
            {
              "lessThan": "8df235f768cea7a5829cb02525622646eb0df5f5",
              "status": "affected",
              "version": "a314f6367787ee1d767df9a2120f17e4511144d0",
              "versionType": "git"
            },
            {
              "lessThan": "65ed52200080eafce3eead05cf22ce01238defca",
              "status": "affected",
              "version": "a314f6367787ee1d767df9a2120f17e4511144d0",
              "versionType": "git"
            },
            {
              "lessThan": "b7ec8a2b094a33d0464958c2cbf75b8f229098b0",
              "status": "affected",
              "version": "a314f6367787ee1d767df9a2120f17e4511144d0",
              "versionType": "git"
            },
            {
              "lessThan": "7446284023e8ef694fb392348185349c773eefb3",
              "status": "affected",
              "version": "a314f6367787ee1d767df9a2120f17e4511144d0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi-cadence-quadspi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.125",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.125",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.10",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: cadence-quadspi: Implement refcount to handle unbind during busy\n\ndriver support indirect read and indirect write operation with\nassumption no force device removal(unbind) operation. However\nforce device removal(removal) is still available to root superuser.\n\nUnbinding driver during operation causes kernel crash. This changes\nensure driver able to handle such operation for indirect read and\nindirect write by implementing refcount to track attached devices\nto the controller and gracefully wait and until attached devices\nremove operation completed before proceed with removal operation."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-01T16:05:33.466Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8ce3ebbe5c718940b4e94f5c25f5720223f893f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/56787f4a75907ae99b5f5842b756fa68e2482f6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/8df235f768cea7a5829cb02525622646eb0df5f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/65ed52200080eafce3eead05cf22ce01238defca"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7ec8a2b094a33d0464958c2cbf75b8f229098b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/7446284023e8ef694fb392348185349c773eefb3"
        }
      ],
      "title": "spi: cadence-quadspi: Implement refcount to handle unbind during busy",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40005",
    "datePublished": "2025-10-20T15:26:52.315Z",
    "dateReserved": "2025-04-16T07:20:57.151Z",
    "dateUpdated": "2026-06-01T16:05:33.466Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23243",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-17T17:47:24.163717Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-17T17:47:33.620Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:46:14.352Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/user_mad.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1371ef6b1ecf3676b8942f5dfb3634fb0648128e",
              "status": "affected",
              "version": "2be8e3ee8efd6f99ce454115c29d09750915021a",
              "versionType": "git"
            },
            {
              "lessThan": "362e45fd9069ffa1523f9f1633b606ebf72060d7",
              "status": "affected",
              "version": "2be8e3ee8efd6f99ce454115c29d09750915021a",
              "versionType": "git"
            },
            {
              "lessThan": "6eb2919474ca105c5b13d19574e25f0ddcf19ca2",
              "status": "affected",
              "version": "2be8e3ee8efd6f99ce454115c29d09750915021a",
              "versionType": "git"
            },
            {
              "lessThan": "a6a3e4af10993cb9e4b8f0548680aba0ab5f3b0d",
              "status": "affected",
              "version": "2be8e3ee8efd6f99ce454115c29d09750915021a",
              "versionType": "git"
            },
            {
              "lessThan": "9c80d688f402539dfc8f336de1380d6b4ee14316",
              "status": "affected",
              "version": "2be8e3ee8efd6f99ce454115c29d09750915021a",
              "versionType": "git"
            },
            {
              "lessThan": "205955f29c26330b1dc7fdeadd5bb97c38e26f56",
              "status": "affected",
              "version": "2be8e3ee8efd6f99ce454115c29d09750915021a",
              "versionType": "git"
            },
            {
              "lessThan": "52ab82cc5cf8ada5c3fb6ffe8f32fdb2fc27a34b",
              "status": "affected",
              "version": "2be8e3ee8efd6f99ce454115c29d09750915021a",
              "versionType": "git"
            },
            {
              "lessThan": "5551b02fdbfd85a325bb857f3a8f9c9f33397ed2",
              "status": "affected",
              "version": "2be8e3ee8efd6f99ce454115c29d09750915021a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/user_mad.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.24"
            },
            {
              "lessThan": "2.6.24",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.252",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.252",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/umad: Reject negative data_len in ib_umad_write\n\nib_umad_write computes data_len from user-controlled count and the\nMAD header sizes. With a mismatched user MAD header size and RMPP\nheader length, data_len can become negative and reach ib_create_send_mad().\nThis can make the padding calculation exceed the segment size and trigger\nan out-of-bounds memset in alloc_send_rmpp_list().\n\nAdd an explicit check to reject negative data_len before creating the\nsend buffer.\n\nKASAN splat:\n[  211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0\n[  211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102\n[  211.365867] ib_create_send_mad+0xa01/0x11b0\n[  211.365887] ib_umad_write+0x853/0x1c80"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is in ib_umad_write(), the write handler for /dev/infiniband/umadX character device files, requiring local system access to open and write to the device.\nAC:L - The attacker reliably controls the count parameter passed to write() and can craft input to make data_len negative, triggering the OOB write deterministically with no race or special conditions.\nPR:L - The /dev/infiniband/umadX device has no capability checks in the code path. On RDMA-enabled systems (HPC clusters, cloud servers), udev rules commonly grant access to unprivileged users. An ioctl to register a MAD agent is needed first but requires no special privileges.\nUI:N - No user interaction is required. The attacker directly opens the device file, registers a MAD agent via ioctl, and triggers the bug by writing crafted data.\nS:U - The vulnerability operates within kernel space and does not cross a security boundary such as a VM or sandbox escape.\nC:H - The out-of-bounds memset write into slab memory can corrupt adjacent heap objects. In a controlled exploit, this memory corruption can be leveraged via heap spraying to gain arbitrary read primitives.\nI:H - KASAN confirmed a slab out-of-bounds write of 220 bytes. This heap corruption can be exploited to overwrite adjacent slab objects, enabling arbitrary write primitives and potential code execution.\nA:H - The out-of-bounds write corrupts slab memory, causing kernel crashes as confirmed by the KASAN splat. This is a reliable kernel panic/oops."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:20:53.089Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1371ef6b1ecf3676b8942f5dfb3634fb0648128e"
        },
        {
          "url": "https://git.kernel.org/stable/c/362e45fd9069ffa1523f9f1633b606ebf72060d7"
        },
        {
          "url": "https://git.kernel.org/stable/c/6eb2919474ca105c5b13d19574e25f0ddcf19ca2"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6a3e4af10993cb9e4b8f0548680aba0ab5f3b0d"
        },
        {
          "url": "https://git.kernel.org/stable/c/9c80d688f402539dfc8f336de1380d6b4ee14316"
        },
        {
          "url": "https://git.kernel.org/stable/c/205955f29c26330b1dc7fdeadd5bb97c38e26f56"
        },
        {
          "url": "https://git.kernel.org/stable/c/52ab82cc5cf8ada5c3fb6ffe8f32fdb2fc27a34b"
        },
        {
          "url": "https://git.kernel.org/stable/c/5551b02fdbfd85a325bb857f3a8f9c9f33397ed2"
        }
      ],
      "title": "RDMA/umad: Reject negative data_len in ib_umad_write",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23243",
    "datePublished": "2026-03-18T10:05:05.826Z",
    "dateReserved": "2026-01-13T15:37:45.989Z",
    "dateUpdated": "2026-08-05T12:20:53.089Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-71089",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T16:19:59.752068Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T16:20:14.545Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/iommu-sva.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b34289505180a83607fcfdce14b5a290d0528476",
              "status": "affected",
              "version": "26b25a2b98e45aeb40eedcedc586ad5034cbd984",
              "versionType": "git"
            },
            {
              "lessThan": "7cad37e358970af1bb49030ff01f06a69fa7d985",
              "status": "affected",
              "version": "26b25a2b98e45aeb40eedcedc586ad5034cbd984",
              "versionType": "git"
            },
            {
              "lessThan": "240cd7f2812cc25496b12063d11c823618f364e9",
              "status": "affected",
              "version": "26b25a2b98e45aeb40eedcedc586ad5034cbd984",
              "versionType": "git"
            },
            {
              "lessThan": "c2c3f1a3fd74ef16cf115f0c558616a13a8471b4",
              "status": "affected",
              "version": "26b25a2b98e45aeb40eedcedc586ad5034cbd984",
              "versionType": "git"
            },
            {
              "lessThan": "c341dee80b5df49a936182341b36395c831c2661",
              "status": "affected",
              "version": "26b25a2b98e45aeb40eedcedc586ad5034cbd984",
              "versionType": "git"
            },
            {
              "lessThan": "72f98ef9a4be30d2a60136dd6faee376f780d06c",
              "status": "affected",
              "version": "26b25a2b98e45aeb40eedcedc586ad5034cbd984",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/iommu-sva.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.200",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.200",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.163",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.120",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.64",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.4",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu: disable SVA when CONFIG_X86 is set\n\nPatch series \"Fix stale IOTLB entries for kernel address space\", v7.\n\nThis proposes a fix for a security vulnerability related to IOMMU Shared\nVirtual Addressing (SVA).  In an SVA context, an IOMMU can cache kernel\npage table entries.  When a kernel page table page is freed and\nreallocated for another purpose, the IOMMU might still hold stale,\nincorrect entries.  This can be exploited to cause a use-after-free or\nwrite-after-free condition, potentially leading to privilege escalation or\ndata corruption.\n\nThis solution introduces a deferred freeing mechanism for kernel page\ntable pages, which provides a safe window to notify the IOMMU to\ninvalidate its caches before the page is reused.\n\n\nThis patch (of 8):\n\nIn the IOMMU Shared Virtual Addressing (SVA) context, the IOMMU hardware\nshares and walks the CPU\u0027s page tables.  The x86 architecture maps the\nkernel\u0027s virtual address space into the upper portion of every process\u0027s\npage table.  Consequently, in an SVA context, the IOMMU hardware can walk\nand cache kernel page table entries.\n\nThe Linux kernel currently lacks a notification mechanism for kernel page\ntable changes, specifically when page table pages are freed and reused. \nThe IOMMU driver is only notified of changes to user virtual address\nmappings.  This can cause the IOMMU\u0027s internal caches to retain stale\nentries for kernel VA.\n\nUse-After-Free (UAF) and Write-After-Free (WAF) conditions arise when\nkernel page table pages are freed and later reallocated.  The IOMMU could\nmisinterpret the new data as valid page table entries.  The IOMMU might\nthen walk into attacker-controlled memory, leading to arbitrary physical\nmemory DMA access or privilege escalation.  This is also a\nWrite-After-Free issue, as the IOMMU will potentially continue to write\nAccessed and Dirty bits to the freed memory while attempting to walk the\nstale page tables.\n\nCurrently, SVA contexts are unprivileged and cannot access kernel\nmappings.  However, the IOMMU will still walk kernel-only page tables all\nthe way down to the leaf entries, where it realizes the mapping is for the\nkernel and errors out.  This means the IOMMU still caches these\nintermediate page table entries, making the described vulnerability a real\nconcern.\n\nDisable SVA on x86 architecture until the IOMMU can receive notification\nto flush the paging cache before freeing the CPU kernel page table pages."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "IOMMU SVA stale kernel page table entries enable arbitrary physical memory DMA access. IOMMU caches kernel page table entries that become stale when freed and reallocated, allowing walk into attacker-controlled memory. Scope Changed as it breaks IOMMU hardware isolation boundary."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:11:58.679Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b34289505180a83607fcfdce14b5a290d0528476"
        },
        {
          "url": "https://git.kernel.org/stable/c/7cad37e358970af1bb49030ff01f06a69fa7d985"
        },
        {
          "url": "https://git.kernel.org/stable/c/240cd7f2812cc25496b12063d11c823618f364e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2c3f1a3fd74ef16cf115f0c558616a13a8471b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/c341dee80b5df49a936182341b36395c831c2661"
        },
        {
          "url": "https://git.kernel.org/stable/c/72f98ef9a4be30d2a60136dd6faee376f780d06c"
        }
      ],
      "title": "iommu: disable SVA when CONFIG_X86 is set",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71089",
    "datePublished": "2026-01-13T15:34:51.079Z",
    "dateReserved": "2026-01-13T15:30:19.649Z",
    "dateUpdated": "2026-08-05T12:11:58.679Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/char/tpm/tpm_i2c_infineon.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8f124c5582d443ac9fb690db26d08cab5d6ba76e",
              "status": "affected",
              "version": "aad628c1d91a6db57e572e4c1f35e863d81061d7",
              "versionType": "git"
            },
            {
              "lessThan": "c24c9c4cab11858f22f309521ba7ea5b1e7385f2",
              "status": "affected",
              "version": "aad628c1d91a6db57e572e4c1f35e863d81061d7",
              "versionType": "git"
            },
            {
              "lessThan": "1bb8f8826d0748b4b92a98fb6b6dfe52081739f5",
              "status": "affected",
              "version": "aad628c1d91a6db57e572e4c1f35e863d81061d7",
              "versionType": "git"
            },
            {
              "lessThan": "948966e546f29af04391d98b8e378e4a7670c1c1",
              "status": "affected",
              "version": "aad628c1d91a6db57e572e4c1f35e863d81061d7",
              "versionType": "git"
            },
            {
              "lessThan": "a61b8412e3eb8b71646dba867e8252d8560a1a27",
              "status": "affected",
              "version": "aad628c1d91a6db57e572e4c1f35e863d81061d7",
              "versionType": "git"
            },
            {
              "lessThan": "1a22048c1117cdfac185ba450aba67ed6b65dc87",
              "status": "affected",
              "version": "aad628c1d91a6db57e572e4c1f35e863d81061d7",
              "versionType": "git"
            },
            {
              "lessThan": "2f7a665e1323359d99c74301d1e180f5e2c40181",
              "status": "affected",
              "version": "aad628c1d91a6db57e572e4c1f35e863d81061d7",
              "versionType": "git"
            },
            {
              "lessThan": "bbd6e97c836cbeb9606d7b7e5dcf8a1d89525713",
              "status": "affected",
              "version": "aad628c1d91a6db57e572e4c1f35e863d81061d7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/char/tpm/tpm_i2c_infineon.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.7"
            },
            {
              "lessThan": "3.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.252",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.252",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure\n\nget_burstcount() can return -EBUSY on timeout. When this happens, the\nfunction returns directly without releasing the locality that was\nacquired at the beginning of tpm_tis_i2c_send().\n\nUse goto out_err to ensure proper cleanup when get_burstcount() fails."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T12:17:57.155Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8f124c5582d443ac9fb690db26d08cab5d6ba76e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c24c9c4cab11858f22f309521ba7ea5b1e7385f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/1bb8f8826d0748b4b92a98fb6b6dfe52081739f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/948966e546f29af04391d98b8e378e4a7670c1c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/a61b8412e3eb8b71646dba867e8252d8560a1a27"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a22048c1117cdfac185ba450aba67ed6b65dc87"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f7a665e1323359d99c74301d1e180f5e2c40181"
        },
        {
          "url": "https://git.kernel.org/stable/c/bbd6e97c836cbeb9606d7b7e5dcf8a1d89525713"
        }
      ],
      "title": "tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45941",
    "datePublished": "2026-05-27T12:17:57.155Z",
    "dateReserved": "2026-05-13T15:03:33.087Z",
    "dateUpdated": "2026-05-27T12:17:57.155Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/v3d/v3d_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "14d0d6c8b4504a60cfeea74775ab2e0164019e65",
              "status": "affected",
              "version": "57692c94dcbe99a1e0444409a3da13fb3443562c",
              "versionType": "git"
            },
            {
              "lessThan": "225023e3619b81af6d8d0e680503fc2d68633023",
              "status": "affected",
              "version": "57692c94dcbe99a1e0444409a3da13fb3443562c",
              "versionType": "git"
            },
            {
              "lessThan": "2663ef70c6123b2232190f917275e5c3175f97d0",
              "status": "affected",
              "version": "57692c94dcbe99a1e0444409a3da13fb3443562c",
              "versionType": "git"
            },
            {
              "lessThan": "cf510785f74e74c54de40a43a955b7f844857487",
              "status": "affected",
              "version": "57692c94dcbe99a1e0444409a3da13fb3443562c",
              "versionType": "git"
            },
            {
              "lessThan": "0290934d30abe7c88e18140fd5184c3f386b1e44",
              "status": "affected",
              "version": "57692c94dcbe99a1e0444409a3da13fb3443562c",
              "versionType": "git"
            },
            {
              "lessThan": "db15f469a88d3bbeeaa9f8c9f5e74d856ba5d7d2",
              "status": "affected",
              "version": "57692c94dcbe99a1e0444409a3da13fb3443562c",
              "versionType": "git"
            },
            {
              "lessThan": "9eb018828b1b30dfba689c060735c50fc5b9f704",
              "status": "affected",
              "version": "57692c94dcbe99a1e0444409a3da13fb3443562c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/v3d/v3d_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Set DMA segment size to avoid debug warnings\n\nWhen using V3D rendering with CONFIG_DMA_API_DEBUG enabled, the\nkernel occasionally reports a segment size mismatch. This is because\n\u0027max_seg_size\u0027 is not set. The kernel defaults to 64K. setting\n\u0027max_seg_size\u0027 to the maximum will prevent \u0027debug_dma_map_sg()\u0027\nfrom complaining about the over-mapping of the V3D segment length.\n\nDMA-API: v3d 1002000000.v3d: mapping sg segment longer than device\n claims to support [len=8290304] [max=65536]\nWARNING: CPU: 0 PID: 493 at kernel/dma/debug.c:1179 debug_dma_map_sg+0x330/0x388\nCPU: 0 UID: 0 PID: 493 Comm: Xorg Not tainted 6.12.53-yocto-standard #1\nHardware name: Raspberry Pi 5 Model B Rev 1.0 (DT)\npstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : debug_dma_map_sg+0x330/0x388\nlr : debug_dma_map_sg+0x330/0x388\nsp : ffff8000829a3ac0\nx29: ffff8000829a3ac0 x28: 0000000000000001 x27: ffff8000813fe000\nx26: ffffc1ffc0000000 x25: ffff00010fdeb760 x24: 0000000000000000\nx23: ffff8000816a9bf0 x22: 0000000000000001 x21: 0000000000000002\nx20: 0000000000000002 x19: ffff00010185e810 x18: ffffffffffffffff\nx17: 69766564206e6168 x16: 74207265676e6f6c x15: 20746e656d676573\nx14: 20677320676e6970 x13: 5d34303334393134 x12: 0000000000000000\nx11: 00000000000000c0 x10: 00000000000009c0 x9 : ffff8000800e0b7c\nx8 : ffff00010a315ca0 x7 : ffff8000816a5110 x6 : 0000000000000001\nx5 : 000000000000002b x4 : 0000000000000002 x3 : 0000000000000008\nx2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00010a315280\nCall trace:\n debug_dma_map_sg+0x330/0x388\n __dma_map_sg_attrs+0xc0/0x278\n dma_map_sgtable+0x30/0x58\n drm_gem_shmem_get_pages_sgt+0xb4/0x140\n v3d_bo_create_finish+0x28/0x130 [v3d]\n v3d_create_bo_ioctl+0x54/0x180 [v3d]\n drm_ioctl_kernel+0xc8/0x140\n drm_ioctl+0x2d4/0x4d8"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:21:55.721Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/14d0d6c8b4504a60cfeea74775ab2e0164019e65"
        },
        {
          "url": "https://git.kernel.org/stable/c/225023e3619b81af6d8d0e680503fc2d68633023"
        },
        {
          "url": "https://git.kernel.org/stable/c/2663ef70c6123b2232190f917275e5c3175f97d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/cf510785f74e74c54de40a43a955b7f844857487"
        },
        {
          "url": "https://git.kernel.org/stable/c/0290934d30abe7c88e18140fd5184c3f386b1e44"
        },
        {
          "url": "https://git.kernel.org/stable/c/db15f469a88d3bbeeaa9f8c9f5e74d856ba5d7d2"
        },
        {
          "url": "https://git.kernel.org/stable/c/9eb018828b1b30dfba689c060735c50fc5b9f704"
        }
      ],
      "title": "drm/v3d: Set DMA segment size to avoid debug warnings",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43302",
    "datePublished": "2026-05-08T13:11:22.886Z",
    "dateReserved": "2026-05-01T14:12:56.000Z",
    "dateUpdated": "2026-05-11T22:21:55.721Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/data.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0fb58aff0dafd6837cc91f4154f3ed6e020358fa",
              "status": "affected",
              "version": "e234088758fca3a669ebb1a02d8bf7bf60f0e4ff",
              "versionType": "git"
            },
            {
              "lessThan": "2f67ff1e15a8a4d0e4ffc6564ab20d03d7398fe9",
              "status": "affected",
              "version": "e234088758fca3a669ebb1a02d8bf7bf60f0e4ff",
              "versionType": "git"
            },
            {
              "lessThan": "505e1c0530db6152cab3feef8e3e4da3d3e358c9",
              "status": "affected",
              "version": "e234088758fca3a669ebb1a02d8bf7bf60f0e4ff",
              "versionType": "git"
            },
            {
              "lessThan": "acc2c97fc0005846e5cf11b5ba3189fef130c9b3",
              "status": "affected",
              "version": "e234088758fca3a669ebb1a02d8bf7bf60f0e4ff",
              "versionType": "git"
            },
            {
              "lessThan": "cf4a9e1bc8129eb63fda5f8bdcd8d87f0bd76f42",
              "status": "affected",
              "version": "e234088758fca3a669ebb1a02d8bf7bf60f0e4ff",
              "versionType": "git"
            },
            {
              "lessThan": "995030be4ce6338c6ff814583c14166446a64008",
              "status": "affected",
              "version": "e234088758fca3a669ebb1a02d8bf7bf60f0e4ff",
              "versionType": "git"
            },
            {
              "lessThan": "a42f99be8a16b32a0bb91bb6dda212a6ad61be5d",
              "status": "affected",
              "version": "e234088758fca3a669ebb1a02d8bf7bf60f0e4ff",
              "versionType": "git"
            },
            {
              "lessThan": "ce2739e482bce8d2c014d76c4531c877f382aa54",
              "status": "affected",
              "version": "e234088758fca3a669ebb1a02d8bf7bf60f0e4ff",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/data.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "lessThan": "3.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.251",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.201",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.164",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.127",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.74",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.251",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.201",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.164",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.127",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.74",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.13",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.3",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid UAF in f2fs_write_end_io()\n\nAs syzbot reported an use-after-free issue in f2fs_write_end_io().\n\nIt is caused by below race condition:\n\nloop device\t\t\t\tumount\n- worker_thread\n - loop_process_work\n  - do_req_filebacked\n   - lo_rw_aio\n    - lo_rw_aio_complete\n     - blk_mq_end_request\n      - blk_update_request\n       - f2fs_write_end_io\n        - dec_page_count\n        - folio_end_writeback\n\t\t\t\t\t- kill_f2fs_super\n\t\t\t\t\t - kill_block_super\n\t\t\t\t\t  - f2fs_put_super\n\t\t\t\t\t : free(sbi)\n       : get_pages(, F2FS_WB_CP_DATA)\n         accessed sbi which is freed\n\nIn kill_f2fs_super(), we will drop all page caches of f2fs inodes before\ncall free(sbi), it guarantee that all folios should end its writeback, so\nit should be safe to access sbi before last folio_end_writeback().\n\nLet\u0027s relocate ckpt thread wakeup flow before folio_end_writeback() to\nresolve this issue."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:02:55.136Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0fb58aff0dafd6837cc91f4154f3ed6e020358fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f67ff1e15a8a4d0e4ffc6564ab20d03d7398fe9"
        },
        {
          "url": "https://git.kernel.org/stable/c/505e1c0530db6152cab3feef8e3e4da3d3e358c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/acc2c97fc0005846e5cf11b5ba3189fef130c9b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/cf4a9e1bc8129eb63fda5f8bdcd8d87f0bd76f42"
        },
        {
          "url": "https://git.kernel.org/stable/c/995030be4ce6338c6ff814583c14166446a64008"
        },
        {
          "url": "https://git.kernel.org/stable/c/a42f99be8a16b32a0bb91bb6dda212a6ad61be5d"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce2739e482bce8d2c014d76c4531c877f382aa54"
        }
      ],
      "title": "f2fs: fix to avoid UAF in f2fs_write_end_io()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23234",
    "datePublished": "2026-03-04T14:36:38.843Z",
    "dateReserved": "2026-01-13T15:37:45.988Z",
    "dateUpdated": "2026-05-11T22:02:55.136Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smbacl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "063a7409b0de46d7c770b65bb0338e6fdb3b1f0a",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "3e5360b422dd741cb315654a191fa73869a37414",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "59c32abaaec9cdd6164811c7e864e72f7554b82d",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "3e4e2ea2a781018ed5d75f969e3e5606beb66e48",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smbacl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.84",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.25",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.84",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.25",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()\n\nsmb_inherit_dacl() trusts the on-disk num_aces value from the parent\ndirectory\u0027s DACL xattr and uses it to size a heap allocation:\n\n  aces_base = kmalloc(sizeof(struct smb_ace) * num_aces * 2, ...);\n\nnum_aces is a u16 read from le16_to_cpu(parent_pdacl-\u003enum_aces)\nwithout checking that it is consistent with the declared pdacl_size.\nAn authenticated client whose parent directory\u0027s security.NTACL is\ntampered (e.g. via offline xattr corruption or a concurrent path that\nbypasses parse_dacl()) can present num_aces = 65535 with minimal\nactual ACE data.  This causes a ~8 MB allocation (not kzalloc, so\nuninitialized) that the subsequent loop only partially populates, and\nmay also overflow the three-way size_t multiply on 32-bit kernels.\n\nAdditionally, the ACE walk loop uses the weaker\noffsetof(struct smb_ace, access_req) minimum size check rather than\nthe minimum valid on-wire ACE size, and does not reject ACEs whose\ndeclared size is below the minimum.\n\nReproduced on UML + KASAN + LOCKDEP against the real ksmbd code path.\nA legitimate mount.cifs client creates a parent directory over SMB\n(ksmbd writes a valid security.NTACL xattr), then the NTACL blob on\nthe backing filesystem is rewritten to set num_aces = 0xFFFF while\nkeeping the posix_acl_hash bytes intact so ksmbd_vfs_get_sd_xattr()\u0027s\nhash check still passes.  A subsequent SMB2 CREATE of a child under\nthat parent drives smb2_open() into smb_inherit_dacl() (share has\n\"vfs objects = acl_xattr\" set), which fails the page allocator:\n\n  WARNING: mm/page_alloc.c:5226 at __alloc_frozen_pages_noprof+0x46c/0x9c0\n  Workqueue: ksmbd-io handle_ksmbd_work\n   __alloc_frozen_pages_noprof+0x46c/0x9c0\n   ___kmalloc_large_node+0x68/0x130\n   __kmalloc_large_node_noprof+0x24/0x70\n   __kmalloc_noprof+0x4c9/0x690\n   smb_inherit_dacl+0x394/0x2430\n   smb2_open+0x595d/0xabe0\n   handle_ksmbd_work+0x3d3/0x1140\n\nWith the patch applied the added guard rejects the tampered value\nwith -EINVAL before any large allocation runs, smb2_open() falls back\nto smb2_create_sd_buffer(), and the child is created with a default\nSD.  No warning, no splat.\n\nFix by:\n\n  1. Validating num_aces against pdacl_size using the same formula\n     applied in parse_dacl().\n\n  2. Replacing the raw kmalloc(sizeof * num_aces * 2) with\n     kmalloc_array(num_aces * 2, sizeof(...)) for overflow-safe\n     allocation.\n\n  3. Tightening the per-ACE loop guard to require the minimum valid\n     ACE size (offsetof(smb_ace, sid) + CIFS_SID_BASE_SIZE) and\n     rejecting under-sized ACEs, matching the hardening in\n     smb_check_perm_dacl() and parse_dacl().\n\nv1 -\u003e v2:\n  - Replace the synthetic test-module splat in the changelog with a\n    real-path UML + KASAN reproduction driven through mount.cifs and\n    SMB2 CREATE; Namjae flagged the kcifs3_test_inherit_dacl_old name\n    in v1 since it does not exist in ksmbd.\n  - Drop the commit-hash citation from the code comment per Namjae\u0027s\n    review; keep the parse_dacl() pointer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ksmbd processes SMB2 CREATE requests over TCP/445, and the vulnerable `smb_inherit_dacl()` path is reached remotely through the in-kernel SMB server.\nAC:L - An attacker with access to a writable ACL-xattr share can deterministically store or arrange a malformed parent DACL and then create a child object to trigger inheritance; no race or uncontrollable condition is required.\nPR:L - The SMB2 CREATE path requires a valid SMB session and tree connection, and the practical attack requires share write/ACL-setting privileges, but not kernel, root, or administrative privileges.\nUI:N - After the attacker has SMB access, exploitation is driven entirely by attacker-sent SMB requests and does not require victim interaction.\nS:U - The vulnerable component and impacted resource are both within the same kernel/ksmbd security authority; this is not a VM escape or cross-boundary isolation bypass.\nC:H - The hardened ACE walk addresses attacker-controlled malformed DACL data that can drive out-of-bounds reads of kernel heap-backed security descriptor data; under the required high-severity tie-break rule, this is scored as high confidentiality impact.\nI:H - The malformed inherited ACE construction can corrupt kernel-managed ACL/security descriptor state and has plausible heap memory-corruption consequences, so the highest defensible integrity impact is high.\nA:H - The documented reproduction triggers a kernel allocator warning from attacker-controlled SMB activity, and such kernel warnings/oops conditions can crash or destabilize the server, especially with panic-on-warn configurations."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:24:40.999Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/063a7409b0de46d7c770b65bb0338e6fdb3b1f0a"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e5360b422dd741cb315654a191fa73869a37414"
        },
        {
          "url": "https://git.kernel.org/stable/c/59c32abaaec9cdd6164811c7e864e72f7554b82d"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e4e2ea2a781018ed5d75f969e3e5606beb66e48"
        }
      ],
      "title": "ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31706",
    "datePublished": "2026-05-01T13:56:04.552Z",
    "dateReserved": "2026-03-09T15:48:24.132Z",
    "dateUpdated": "2026-08-05T12:24:40.999Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/most/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bbfe49ffb892bddf32c34bea95b7ff0fc30affb5",
              "status": "affected",
              "version": "723de0f9171eeb49a3ae98cae82ebbbb992b3a7c",
              "versionType": "git"
            },
            {
              "lessThan": "f1ba620f9e8d7291f80c0554e4b820f5fb30e819",
              "status": "affected",
              "version": "723de0f9171eeb49a3ae98cae82ebbbb992b3a7c",
              "versionType": "git"
            },
            {
              "lessThan": "5fd4396c2e48e90cc2597a86c18227d56ea845f0",
              "status": "affected",
              "version": "723de0f9171eeb49a3ae98cae82ebbbb992b3a7c",
              "versionType": "git"
            },
            {
              "lessThan": "2c198c272f9c9213b0fdf6b4a879f445c574f416",
              "status": "affected",
              "version": "723de0f9171eeb49a3ae98cae82ebbbb992b3a7c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/most/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmost: core: fix leak on early registration failure\n\nA recent commit fixed a resource leak on early registration failures but\nfor some reason left out the first error path which still leaks the\nresources associated with the interface.\n\nFix up also the first error path so that the interface is always\nreleased on errors."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:22:13.350Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bbfe49ffb892bddf32c34bea95b7ff0fc30affb5"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1ba620f9e8d7291f80c0554e4b820f5fb30e819"
        },
        {
          "url": "https://git.kernel.org/stable/c/5fd4396c2e48e90cc2597a86c18227d56ea845f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c198c272f9c9213b0fdf6b4a879f445c574f416"
        }
      ],
      "title": "most: core: fix leak on early registration failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43317",
    "datePublished": "2026-05-08T13:26:12.899Z",
    "dateReserved": "2026-05-01T14:12:56.001Z",
    "dateUpdated": "2026-05-11T22:22:13.350Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/time/clockevents.c",
            "kernel/time/tick-broadcast.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9401b593fa48218d2667df1610b0ebc518554880",
              "status": "affected",
              "version": "d6e152d905bdb1f32f9d99775e2f453350399a6a",
              "versionType": "git"
            },
            {
              "lessThan": "4096fd0e8eaea13ebe5206700b33f49635ae18e5",
              "status": "affected",
              "version": "d6e152d905bdb1f32f9d99775e2f453350399a6a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/time/clockevents.c",
            "kernel/time/tick-broadcast.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.1",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclockevents: Add missing resets of the next_event_forced flag\n\nThe prevention mechanism against timer interrupt starvation missed to reset\nthe next_event_forced flag in a couple of places:\n\n    - When the clock event state changes. That can cause the flag to be\n      stale over a shutdown/startup sequence\n\n    - When a non-forced event is armed, which then prevents rearming before\n      that event. If that event is far out in the future this will cause\n      missed timer interrupts.\n\n    - In the suspend wakeup handler.\n\nThat led to stalls which have been reported by several people.\n\nAdd the missing resets, which fixes the problems for the reporters."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-14T17:41:57.072Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9401b593fa48218d2667df1610b0ebc518554880"
        },
        {
          "url": "https://git.kernel.org/stable/c/4096fd0e8eaea13ebe5206700b33f49635ae18e5"
        }
      ],
      "title": "clockevents: Add missing resets of the next_event_forced flag",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31574",
    "datePublished": "2026-04-24T14:42:06.707Z",
    "dateReserved": "2026-03-09T15:48:24.119Z",
    "dateUpdated": "2026-06-14T17:41:57.072Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_buddy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d764b8dd420098a4d253b8a5b27568c897edb2cf",
              "status": "affected",
              "version": "0a1844bf0b532d84324453374ad6845f64066c28",
              "versionType": "git"
            },
            {
              "lessThan": "6236c1cd9fdf433d39ed28b2491ccdfe7ae95061",
              "status": "affected",
              "version": "0a1844bf0b532d84324453374ad6845f64066c28",
              "versionType": "git"
            },
            {
              "lessThan": "ecb32c60d8cbed2ee9ce9f343b6aa2f32babc727",
              "status": "affected",
              "version": "0a1844bf0b532d84324453374ad6845f64066c28",
              "versionType": "git"
            },
            {
              "lessThan": "5488a29596cdba93a60a79398dc9b69d5bdadf92",
              "status": "affected",
              "version": "0a1844bf0b532d84324453374ad6845f64066c28",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_buddy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/buddy: Prevent BUG_ON by validating rounded allocation\n\nWhen DRM_BUDDY_CONTIGUOUS_ALLOCATION is set, the requested size is\nrounded up to the next power-of-two via roundup_pow_of_two().\nSimilarly, for non-contiguous allocations with large min_block_size,\nthe size is aligned up via round_up(). Both operations can produce a\nrounded size that exceeds mm-\u003esize, which later triggers\nBUG_ON(order \u003e mm-\u003emax_order).\n\nExample scenarios:\n- 9G CONTIGUOUS allocation on 10G VRAM memory:\n  roundup_pow_of_two(9G) = 16G \u003e 10G\n- 9G allocation with 8G min_block_size on 10G VRAM memory:\n  round_up(9G, 8G) = 16G \u003e 10G\n\nFix this by checking the rounded size against mm-\u003esize. For\nnon-contiguous or range allocations where size \u003e mm-\u003esize is invalid,\nreturn -EINVAL immediately. For contiguous allocations without range\nrestrictions, allow the request to fall through to the existing\n__alloc_contig_try_harder() fallback.\n\nThis ensures invalid user input returns an error or uses the fallback\npath instead of hitting BUG_ON.\n\nv2: (Matt A)\n- Add Fixes, Cc stable, and Closes tags for context"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:19:07.323Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d764b8dd420098a4d253b8a5b27568c897edb2cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/6236c1cd9fdf433d39ed28b2491ccdfe7ae95061"
        },
        {
          "url": "https://git.kernel.org/stable/c/ecb32c60d8cbed2ee9ce9f343b6aa2f32babc727"
        },
        {
          "url": "https://git.kernel.org/stable/c/5488a29596cdba93a60a79398dc9b69d5bdadf92"
        }
      ],
      "title": "drm/buddy: Prevent BUG_ON by validating rounded allocation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43169",
    "datePublished": "2026-05-06T11:27:45.356Z",
    "dateReserved": "2026-05-01T14:12:55.990Z",
    "dateUpdated": "2026-05-11T22:19:07.323Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/pm_kernel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "338d40bab283da2639780ee3e458fb61f1567d8c",
              "status": "affected",
              "version": "141694df6573b49aa4143c92556544b4b0bbda72",
              "versionType": "git"
            },
            {
              "lessThan": "7896dbe990d56d5bb8097863b2645355633665eb",
              "status": "affected",
              "version": "141694df6573b49aa4143c92556544b4b0bbda72",
              "versionType": "git"
            },
            {
              "lessThan": "455e882192c9833f176f3fbbbb2f036b6c5bf555",
              "status": "affected",
              "version": "141694df6573b49aa4143c92556544b4b0bbda72",
              "versionType": "git"
            },
            {
              "lessThan": "51223bdd0f60b06cfc7f25885c4d4be917adba94",
              "status": "affected",
              "version": "141694df6573b49aa4143c92556544b4b0bbda72",
              "versionType": "git"
            },
            {
              "lessThan": "1f1b9523527df02685dde603f20ff6e603d8e4a1",
              "status": "affected",
              "version": "141694df6573b49aa4143c92556544b4b0bbda72",
              "versionType": "git"
            },
            {
              "lessThan": "e2a9eeb69f7d4ca4cf4c70463af77664fdb6ab1d",
              "status": "affected",
              "version": "141694df6573b49aa4143c92556544b4b0bbda72",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/pm_kernel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.201",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.164",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.125",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.72",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.201",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.164",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.125",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.72",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.9",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix race in mptcp_pm_nl_flush_addrs_doit()\n\nsyzbot and Eulgyu Kim reported crashes in mptcp_pm_nl_get_local_id()\nand/or mptcp_pm_nl_is_backup()\n\nRoot cause is list_splice_init() in mptcp_pm_nl_flush_addrs_doit()\nwhich is not RCU ready.\n\nlist_splice_init_rcu() can not be called here while holding pernet-\u003elock\nspinlock.\n\nMany thanks to Eulgyu Kim for providing a repro and testing our patches."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability requires a local attacker to send a netlink MPTCP_PM_CMD_FLUSH_ADDRS command, which requires CAP_NET_ADMIN (accessible via user namespaces but still local access). The RCU reader side can be triggered by network MPTCP connections, but the flush side requires local netlink access.\nAC:L - The attacker controls both sides of the race \u2014 they can issue the netlink flush command while simultaneously establishing MPTCP connections that trigger RCU list traversal. Since the attacker creates and controls the race condition, complexity is low.\nPR:L - The flush_addrs netlink operation uses GENL_UNS_ADMIN_PERM, which checks CAP_NET_ADMIN in the user namespace via netlink_ns_capable(). An unprivileged user can obtain this capability through user namespaces (unshare -Urn).\nUI:N - No user interaction is required. The attacker can trigger both the netlink flush and the MPTCP connection processing independently without any victim action.\nS:U - The vulnerability exists within the kernel and impacts the same security context. There is no crossing of a virtualization or sandbox boundary.\nC:H - This is a use-after-free / list corruption bug where RCU readers access freed mptcp_pm_addr_entry structures. UAF gives the attacker control over freed object contents via heap spraying, enabling arbitrary kernel memory reads.\nI:H - The use-after-free on mptcp_pm_addr_entry structures (which contain function-relevant pointers and a socket pointer) can be exploited via heap spraying to achieve arbitrary write primitives and potentially control flow hijacking.\nA:H - The corrupted list pointers and use-after-free reliably cause kernel crashes (oops/panic) as reported by syzbot, providing a straightforward denial-of-service vector."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:20:24.946Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/338d40bab283da2639780ee3e458fb61f1567d8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/7896dbe990d56d5bb8097863b2645355633665eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/455e882192c9833f176f3fbbbb2f036b6c5bf555"
        },
        {
          "url": "https://git.kernel.org/stable/c/51223bdd0f60b06cfc7f25885c4d4be917adba94"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f1b9523527df02685dde603f20ff6e603d8e4a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2a9eeb69f7d4ca4cf4c70463af77664fdb6ab1d"
        }
      ],
      "title": "mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23169",
    "datePublished": "2026-02-14T16:01:32.139Z",
    "dateReserved": "2026-01-13T15:37:45.982Z",
    "dateUpdated": "2026-08-05T12:20:24.946Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/svm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ebb63390142c6458fc37758e0892759989cc159f",
              "status": "affected",
              "version": "ff092385e8285c03d8b148f42f46f98c5f4becd5",
              "versionType": "git"
            },
            {
              "lessThan": "491139c17f8ad5773303068411f6ac5eed438b51",
              "status": "affected",
              "version": "ff092385e8285c03d8b148f42f46f98c5f4becd5",
              "versionType": "git"
            },
            {
              "lessThan": "3ac9d4241d205f5d0df06358349ca718ebb0fa12",
              "status": "affected",
              "version": "ff092385e8285c03d8b148f42f46f98c5f4becd5",
              "versionType": "git"
            },
            {
              "lessThan": "643125b66ffc1147c66616b749475ba9efb15971",
              "status": "affected",
              "version": "ff092385e8285c03d8b148f42f46f98c5f4becd5",
              "versionType": "git"
            },
            {
              "lessThan": "c15392ed9e49c1a16b4d3a3ccf1b3bf2318a6c28",
              "status": "affected",
              "version": "ff092385e8285c03d8b148f42f46f98c5f4becd5",
              "versionType": "git"
            },
            {
              "lessThan": "ee24928ecd85db4b68ed111e91fef36af0ca37b0",
              "status": "affected",
              "version": "ff092385e8285c03d8b148f42f46f98c5f4becd5",
              "versionType": "git"
            },
            {
              "lessThan": "d99df02ff427f461102230f9c5b90a6c64ee8e23",
              "status": "affected",
              "version": "ff092385e8285c03d8b148f42f46f98c5f4becd5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/svm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.32"
            },
            {
              "lessThan": "2.6.32",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.86",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0\n\nINVLPGA should cause a #UD when EFER.SVME is not set. Add a check to\nproperly inject #UD when EFER.SVME=0.\n\n[sean: tag for stable@]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-14T17:53:00.593Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ebb63390142c6458fc37758e0892759989cc159f"
        },
        {
          "url": "https://git.kernel.org/stable/c/491139c17f8ad5773303068411f6ac5eed438b51"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ac9d4241d205f5d0df06358349ca718ebb0fa12"
        },
        {
          "url": "https://git.kernel.org/stable/c/643125b66ffc1147c66616b749475ba9efb15971"
        },
        {
          "url": "https://git.kernel.org/stable/c/c15392ed9e49c1a16b4d3a3ccf1b3bf2318a6c28"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee24928ecd85db4b68ed111e91fef36af0ca37b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/d99df02ff427f461102230f9c5b90a6c64ee8e23"
        }
      ],
      "title": "KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46082",
    "datePublished": "2026-05-27T12:58:21.629Z",
    "dateReserved": "2026-05-13T15:03:33.096Z",
    "dateUpdated": "2026-06-14T17:53:00.593Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtw88/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "71dee092903adb496fe1f357b267d94087b679e0",
              "status": "affected",
              "version": "ad6741b1e0449ba8f4eb41dc28e269dc20ab9219",
              "versionType": "git"
            },
            {
              "lessThan": "7d31dde1bd8678115329e46dc8d7afb63c176b74",
              "status": "affected",
              "version": "ad6741b1e0449ba8f4eb41dc28e269dc20ab9219",
              "versionType": "git"
            },
            {
              "lessThan": "13394550441557115bb74f6de9778c165755a7ab",
              "status": "affected",
              "version": "ad6741b1e0449ba8f4eb41dc28e269dc20ab9219",
              "versionType": "git"
            },
            {
              "lessThan": "653f8b6a091538b084715f259900f62c2ec1c6cf",
              "status": "affected",
              "version": "ad6741b1e0449ba8f4eb41dc28e269dc20ab9219",
              "versionType": "git"
            },
            {
              "lessThan": "0177aa828d966117ea30a44f2e1890fdb356118e",
              "status": "affected",
              "version": "ad6741b1e0449ba8f4eb41dc28e269dc20ab9219",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtw88/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.125",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.72",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.125",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.72",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.11",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.1",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: Fix alignment fault in rtw_core_enable_beacon()\n\nrtw_core_enable_beacon() reads 4 bytes from an address that is not a\nmultiple of 4. This results in a crash on some systems.\n\nDo 1 byte reads/writes instead.\n\nUnable to handle kernel paging request at virtual address ffff8000827e0522\nMem abort info:\n  ESR = 0x0000000096000021\n  EC = 0x25: DABT (current EL), IL = 32 bits\n  SET = 0, FnV = 0\n  EA = 0, S1PTW = 0\n  FSC = 0x21: alignment fault\nData abort info:\n  ISV = 0, ISS = 0x00000021, ISS2 = 0x00000000\n  CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\nswapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000005492000\n[ffff8000827e0522] pgd=0000000000000000, p4d=10000001021d9403, pud=10000001021da403, pmd=100000011061c403, pte=00780000f3200f13\nInternal error: Oops: 0000000096000021 [#1]  SMP\nModules linked in: [...] rtw88_8822ce rtw88_8822c rtw88_pci rtw88_core [...]\nCPU: 0 UID: 0 PID: 73 Comm: kworker/u32:2 Tainted: G        W           6.17.9 #1-NixOS VOLUNTARY\nTainted: [W]=WARN\nHardware name: FriendlyElec NanoPC-T6 LTS (DT)\nWorkqueue: phy0 rtw_c2h_work [rtw88_core]\npstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : rtw_pci_read32+0x18/0x40 [rtw88_pci]\nlr : rtw_core_enable_beacon+0xe0/0x148 [rtw88_core]\nsp : ffff800080cc3ca0\nx29: ffff800080cc3ca0 x28: ffff0001031fc240 x27: ffff000102100828\nx26: ffffd2cb7c9b4088 x25: ffff0001031fc2c0 x24: ffff000112fdef00\nx23: ffff000112fdef18 x22: ffff000111c29970 x21: 0000000000000001\nx20: 0000000000000001 x19: ffff000111c22040 x18: 0000000000000000\nx17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000\nx14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000\nx11: 0000000000000000 x10: 0000000000000000 x9 : ffffd2cb6507c090\nx8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000\nx5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000\nx2 : 0000000000007f10 x1 : 0000000000000522 x0 : ffff8000827e0522\nCall trace:\n rtw_pci_read32+0x18/0x40 [rtw88_pci] (P)\n rtw_hw_scan_chan_switch+0x124/0x1a8 [rtw88_core]\n rtw_fw_c2h_cmd_handle+0x254/0x290 [rtw88_core]\n rtw_c2h_work+0x50/0x98 [rtw88_core]\n process_one_work+0x178/0x3f8\n worker_thread+0x208/0x418\n kthread+0x120/0x220\n ret_from_fork+0x10/0x20\nCode: d28fe202 8b020000 f9524400 8b214000 (b9400000)\n---[ end trace 0000000000000000 ]---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:56:49.865Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/71dee092903adb496fe1f357b267d94087b679e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d31dde1bd8678115329e46dc8d7afb63c176b74"
        },
        {
          "url": "https://git.kernel.org/stable/c/13394550441557115bb74f6de9778c165755a7ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/653f8b6a091538b084715f259900f62c2ec1c6cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/0177aa828d966117ea30a44f2e1890fdb356118e"
        }
      ],
      "title": "wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71229",
    "datePublished": "2026-02-18T14:53:13.412Z",
    "dateReserved": "2026-02-14T16:26:02.970Z",
    "dateUpdated": "2026-05-11T21:56:49.865Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_isr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "408bfa8d70f79ac696cec1bdbdfb3bf43a02e6d0",
              "status": "affected",
              "version": "875386b98857822b77ac7f95bdf367b70af5b78c",
              "versionType": "git"
            },
            {
              "lessThan": "1922468a4a80424e5a69f7ba50adcee37f4722e9",
              "status": "affected",
              "version": "875386b98857822b77ac7f95bdf367b70af5b78c",
              "versionType": "git"
            },
            {
              "lessThan": "aa14451fa5d5f2de919384c637e2a8c604e1a1fe",
              "status": "affected",
              "version": "875386b98857822b77ac7f95bdf367b70af5b78c",
              "versionType": "git"
            },
            {
              "lessThan": "19bc5f2a6962dfaa0e32d0e0bc2271993d85d414",
              "status": "affected",
              "version": "875386b98857822b77ac7f95bdf367b70af5b78c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_isr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.122",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.68",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.122",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.68",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.8",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Sanitize payload size to prevent member overflow\n\nIn qla27xx_copy_fpin_pkt() and qla27xx_copy_multiple_pkt(), the frame_size\nreported by firmware is used to calculate the copy length into\nitem-\u003eiocb. However, the iocb member is defined as a fixed-size 64-byte\narray within struct purex_item.\n\nIf the reported frame_size exceeds 64 bytes, subsequent memcpy calls will\noverflow the iocb member boundary. While extra memory might be allocated,\nthis cross-member write is unsafe and triggers warnings under\nCONFIG_FORTIFY_SOURCE.\n\nFix this by capping total_bytes to the size of the iocb member (64 bytes)\nbefore allocation and copying. This ensures all copies remain within the\nbounds of the destination structure member."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:59:12.428Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/408bfa8d70f79ac696cec1bdbdfb3bf43a02e6d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/1922468a4a80424e5a69f7ba50adcee37f4722e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa14451fa5d5f2de919384c637e2a8c604e1a1fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/19bc5f2a6962dfaa0e32d0e0bc2271993d85d414"
        }
      ],
      "title": "scsi: qla2xxx: Sanitize payload size to prevent member overflow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23059",
    "datePublished": "2026-02-04T16:07:42.150Z",
    "dateReserved": "2026-01-13T15:37:45.952Z",
    "dateUpdated": "2026-05-11T21:59:12.428Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c",
            "drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "52defdd4034db1a34bb48006f889d66a3629224b",
              "status": "affected",
              "version": "9707a6254a8a6b978bde811a44fe07d86c229d1c",
              "versionType": "git"
            },
            {
              "lessThan": "1de71556cbd6e1d0d26fb86b9b3bb8caa0df8495",
              "status": "affected",
              "version": "9707a6254a8a6b978bde811a44fe07d86c229d1c",
              "versionType": "git"
            },
            {
              "lessThan": "32e9e45cf7e3422d21fa64535588d3572faf71c3",
              "status": "affected",
              "version": "9707a6254a8a6b978bde811a44fe07d86c229d1c",
              "versionType": "git"
            },
            {
              "lessThan": "a519e21e32398459ba357e67b541402f7295ee1b",
              "status": "affected",
              "version": "9707a6254a8a6b978bde811a44fe07d86c229d1c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c",
            "drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: chips-media: wave5: Fix memory leak on codec_info allocation failure\n\nIn wave5_vpu_open_enc() and wave5_vpu_open_dec(), a vpu instance is\nallocated via kzalloc(). If the subsequent allocation for inst-\u003ecodec_info\nfails, the functions return -ENOMEM without freeing the previously\nallocated instance, causing a memory leak.\n\nFix this by calling kfree() on the instance in this error path to ensure\nit is properly released."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T12:17:47.075Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/52defdd4034db1a34bb48006f889d66a3629224b"
        },
        {
          "url": "https://git.kernel.org/stable/c/1de71556cbd6e1d0d26fb86b9b3bb8caa0df8495"
        },
        {
          "url": "https://git.kernel.org/stable/c/32e9e45cf7e3422d21fa64535588d3572faf71c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/a519e21e32398459ba357e67b541402f7295ee1b"
        }
      ],
      "title": "media: chips-media: wave5: Fix memory leak on codec_info allocation failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45928",
    "datePublished": "2026-05-27T12:17:47.075Z",
    "dateReserved": "2026-05-13T15:03:33.086Z",
    "dateUpdated": "2026-05-27T12:17:47.075Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:45:51.178Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23038",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T20:32:12.394629Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T20:32:22.872Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/flexfilelayout/flexfilelayoutdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e2dde5dafb80f1af4028ed10ad255f42af71c784",
              "status": "affected",
              "version": "d67ae825a59d639e4d8b82413af84d854617a87e",
              "versionType": "git"
            },
            {
              "lessThan": "27c90d8ed81e7a289c9fe41b5e31d8bb609a3385",
              "status": "affected",
              "version": "d67ae825a59d639e4d8b82413af84d854617a87e",
              "versionType": "git"
            },
            {
              "lessThan": "34b9dd179818ff7af2b36410985fd8166573c62d",
              "status": "affected",
              "version": "d67ae825a59d639e4d8b82413af84d854617a87e",
              "versionType": "git"
            },
            {
              "lessThan": "869862056e100973e76ce9f5f1b01837771b7722",
              "status": "affected",
              "version": "d67ae825a59d639e4d8b82413af84d854617a87e",
              "versionType": "git"
            },
            {
              "lessThan": "86da7efd12295a7e2b4abde5e5984c821edd938f",
              "status": "affected",
              "version": "d67ae825a59d639e4d8b82413af84d854617a87e",
              "versionType": "git"
            },
            {
              "lessThan": "ed5d3f2f6885eb99f729e6ffd946e3aa058bd3eb",
              "status": "affected",
              "version": "d67ae825a59d639e4d8b82413af84d854617a87e",
              "versionType": "git"
            },
            {
              "lessThan": "0c728083654f0066f5e10a1d2b0bd0907af19a58",
              "status": "affected",
              "version": "d67ae825a59d639e4d8b82413af84d854617a87e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfs/flexfilelayout/flexfilelayoutdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.0"
            },
            {
              "lessThan": "4.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.249",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.199",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.122",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.67",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.249",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.199",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.162",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.122",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.67",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.7",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()\n\nIn nfs4_ff_alloc_deviceid_node(), if the allocation for ds_versions fails,\nthe function jumps to the out_scratch label without freeing the already\nallocated dsaddrs list, leading to a memory leak.\n\nFix this by jumping to the out_err_drain_dsaddrs label, which properly\nfrees the dsaddrs list before cleaning up other resources."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:58:48.041Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e2dde5dafb80f1af4028ed10ad255f42af71c784"
        },
        {
          "url": "https://git.kernel.org/stable/c/27c90d8ed81e7a289c9fe41b5e31d8bb609a3385"
        },
        {
          "url": "https://git.kernel.org/stable/c/34b9dd179818ff7af2b36410985fd8166573c62d"
        },
        {
          "url": "https://git.kernel.org/stable/c/869862056e100973e76ce9f5f1b01837771b7722"
        },
        {
          "url": "https://git.kernel.org/stable/c/86da7efd12295a7e2b4abde5e5984c821edd938f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed5d3f2f6885eb99f729e6ffd946e3aa058bd3eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c728083654f0066f5e10a1d2b0bd0907af19a58"
        }
      ],
      "title": "pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23038",
    "datePublished": "2026-01-31T11:42:32.599Z",
    "dateReserved": "2026-01-13T15:37:45.943Z",
    "dateUpdated": "2026-07-14T12:45:51.178Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/damon.h",
            "mm/damon/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0ba956a239ba6e3fae8555d3660e22e675be63b5",
              "status": "affected",
              "version": "bf0eaba0ff9c9c8e6fd58ddfa1a8b6df4b813f61",
              "versionType": "git"
            },
            {
              "lessThan": "33c3f6c2b48cd84b441dba1ee3e62290e53930f4",
              "status": "affected",
              "version": "bf0eaba0ff9c9c8e6fd58ddfa1a8b6df4b813f61",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/damon.h",
            "mm/damon/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/core: fix damos_walk() vs kdamond_fn() exit race\n\nWhen kdamond_fn() main loop is finished, the function cancels remaining\ndamos_walk() request and unset the damon_ctx-\u003ekdamond so that API callers\nand API functions themselves can show the context is terminated. \ndamos_walk() adds the caller\u0027s request to the queue first.  After that, it\nshows if the kdamond of the damon_ctx is still running (damon_ctx-\u003ekdamond\nis set).  Only if the kdamond is running, damos_walk() starts waiting for\nthe kdamond\u0027s handling of the newly added request.\n\nThe damos_walk() requests registration and damon_ctx-\u003ekdamond unset are\nprotected by different mutexes, though.  Hence, damos_walk() could race\nwith damon_ctx-\u003ekdamond unset, and result in deadlocks.\n\nFor example, let\u0027s suppose kdamond successfully finished the damow_walk()\nrequest cancelling.  Right after that, damos_walk() is called for the\ncontext.  It registers the new request, and shows the context is still\nrunning, because damon_ctx-\u003ekdamond unset is not yet done.  Hence the\ndamos_walk() caller starts waiting for the handling of the request. \nHowever, the kdamond is already on the termination steps, so it never\nhandles the new request.  As a result, the damos_walk() caller thread\ninfinitely waits.\n\nFix this by introducing another damon_ctx field, namely\nwalk_control_obsolete.  It is protected by the\ndamon_ctx-\u003ewalk_control_lock, which protects damos_walk() request\nregistration.  Initialize (unset) it in kdamond_fn() before letting\ndamon_start() returns and set it just before the cancelling of the\nremaining damos_walk() request is executed.  damos_walk() reads the\nobsolete field under the lock and avoids adding a new request.\n\nAfter this change, only requests that are guaranteed to be handled or\ncancelled are registered.  Hence the after-registration DAMON context\ntermination check is no longer needed.  Remove it together.\n\nThe issue is found by sashiko [1]."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-14T17:47:40.288Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0ba956a239ba6e3fae8555d3660e22e675be63b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/33c3f6c2b48cd84b441dba1ee3e62290e53930f4"
        }
      ],
      "title": "mm/damon/core: fix damos_walk() vs kdamond_fn() exit race",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46008",
    "datePublished": "2026-05-27T12:56:08.315Z",
    "dateReserved": "2026-05-13T15:03:33.092Z",
    "dateUpdated": "2026-06-14T17:47:40.288Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:49:07.122Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "crypto/authencesn.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8c62f618576519dbed6816fafc623ce592953025",
              "status": "affected",
              "version": "104880a6b470958ddc30e139c41aa4f6ed3a5234",
              "versionType": "git"
            },
            {
              "lessThan": "d589abd8b019b07075fda255ceab8c8e950cdb3f",
              "status": "affected",
              "version": "104880a6b470958ddc30e139c41aa4f6ed3a5234",
              "versionType": "git"
            },
            {
              "lessThan": "5466e7d0cd9e4f9cef9d8f18f18b60e7bc1c77e5",
              "status": "affected",
              "version": "104880a6b470958ddc30e139c41aa4f6ed3a5234",
              "versionType": "git"
            },
            {
              "lessThan": "d0c4ff6812386880f30bc64c2921299cc4d7b47f",
              "status": "affected",
              "version": "104880a6b470958ddc30e139c41aa4f6ed3a5234",
              "versionType": "git"
            },
            {
              "lessThan": "89fe118b6470119b20c04afc36e45b81a69ea11f",
              "status": "affected",
              "version": "104880a6b470958ddc30e139c41aa4f6ed3a5234",
              "versionType": "git"
            },
            {
              "lessThan": "153d5520c3f9fd62e71c7e7f9e34b59cf411e555",
              "status": "affected",
              "version": "104880a6b470958ddc30e139c41aa4f6ed3a5234",
              "versionType": "git"
            },
            {
              "lessThan": "cded4002d22177e8deaca1f257ecd932c9582b6b",
              "status": "affected",
              "version": "104880a6b470958ddc30e139c41aa4f6ed3a5234",
              "versionType": "git"
            },
            {
              "lessThan": "e02494114ebf7c8b42777c6cd6982f113bfdbec7",
              "status": "affected",
              "version": "104880a6b470958ddc30e139c41aa4f6ed3a5234",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "crypto/authencesn.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.3"
            },
            {
              "lessThan": "4.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.254",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.204",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.170",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.137",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.85",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.254",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.204",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.170",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.137",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.85",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.22",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.12",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption\n\nWhen decrypting data that is not in-place (src != dst), there is\nno need to save the high-order sequence bits in dst as it could\nsimply be re-copied from the source.\n\nHowever, the data to be hashed need to be rearranged accordingly.\n\n\nThanks,"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable out-of-place AEAD decrypt path is reachable by a local process through AF_ALG sockets using authencesn, while normal inbound ESP uses in-place src==dst. This requires local syscall access rather than remote packets directly reaching the bad branch.\nAC:L - The attacker controls the AF_ALG request buffers, associated-data length, operation type, key, and authsize, and no race or hard-to-influence state is required. The fault occurs before ICV verification, so a valid packet/tag is not needed.\nPR:L - AF_ALG socket creation, bind, key setup, and AEAD decrypt do not require CAP_NET_ADMIN or CAP_SYS_ADMIN, but the attacker needs local unprivileged code execution. XFRM state management is privileged, but the lower-privilege AF_ALG path reaches the bug.\nUI:N - No victim action is required once the local attacker runs the AF_ALG syscall sequence. The attacker supplies both input and output buffers directly.\nS:U - The vulnerability is in kernel crypto processing and impacts the same kernel security authority. It does not cross a VM, IOMMU, or other separate security boundary.\nC:H - The bug is a kernel memory-corruption condition from writing ESN high sequence bytes past the intended out-of-place destination; successful exploitation of such corruption could expose arbitrary kernel memory. Under the required uncertainty rule, this is scored as high confidentiality impact.\nI:H - The vulnerable code performs an attacker-influenced out-of-bounds write of four bytes before authentication succeeds. Kernel out-of-bounds writes are scored as high integrity impact because they can plausibly be shaped into control-flow or data corruption.\nA:H - At minimum, the AF_ALG path can drive scatterwalk past the end of the destination scatterlist and crash the kernel. A local attacker can repeat the trigger without authentication, causing high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:25:26.050Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8c62f618576519dbed6816fafc623ce592953025"
        },
        {
          "url": "https://git.kernel.org/stable/c/d589abd8b019b07075fda255ceab8c8e950cdb3f"
        },
        {
          "url": "https://git.kernel.org/stable/c/5466e7d0cd9e4f9cef9d8f18f18b60e7bc1c77e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0c4ff6812386880f30bc64c2921299cc4d7b47f"
        },
        {
          "url": "https://git.kernel.org/stable/c/89fe118b6470119b20c04afc36e45b81a69ea11f"
        },
        {
          "url": "https://git.kernel.org/stable/c/153d5520c3f9fd62e71c7e7f9e34b59cf411e555"
        },
        {
          "url": "https://git.kernel.org/stable/c/cded4002d22177e8deaca1f257ecd932c9582b6b"
        },
        {
          "url": "https://git.kernel.org/stable/c/e02494114ebf7c8b42777c6cd6982f113bfdbec7"
        }
      ],
      "title": "crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43033",
    "datePublished": "2026-05-01T14:15:32.583Z",
    "dateReserved": "2026-05-01T14:12:55.977Z",
    "dateUpdated": "2026-08-05T12:25:26.050Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/br_multicast.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d0fdad1bdd21a358cc2c85da3681ae27b86ce6ce",
              "status": "affected",
              "version": "b57e8d870d522d905720052e6fd9c3bc9bc5f6fb",
              "versionType": "git"
            },
            {
              "lessThan": "724a405ce0309676f1e993c173382b4c4a022beb",
              "status": "affected",
              "version": "b57e8d870d522d905720052e6fd9c3bc9bc5f6fb",
              "versionType": "git"
            },
            {
              "lessThan": "fae260fc84e1eae8f590c7907e53e8768df2d986",
              "status": "affected",
              "version": "b57e8d870d522d905720052e6fd9c3bc9bc5f6fb",
              "versionType": "git"
            },
            {
              "lessThan": "45525fdfd4cb612d7b414dd5cfa1f43892a7cd71",
              "status": "affected",
              "version": "b57e8d870d522d905720052e6fd9c3bc9bc5f6fb",
              "versionType": "git"
            },
            {
              "lessThan": "8b769e311a86bb9d15c5658ad283b86fc8f080a2",
              "status": "affected",
              "version": "b57e8d870d522d905720052e6fd9c3bc9bc5f6fb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/br_multicast.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: mcast: always update mdb_n_entries for vlan contexts\n\nsyzbot triggered a warning[1] about the number of mdb entries in a context.\nIt turned out that there are multiple ways to trigger that warning today\n(some got added during the years), the root cause of the problem is that\nthe increase is done conditionally, and over the years these different\nconditions increased so there were new ways to trigger the warning, that is\nto do a decrease which wasn\u0027t paired with a previous increase.\n\nFor example one way to trigger it is with flush:\n $ ip l add br0 up type bridge vlan_filtering 1 mcast_snooping 1\n $ ip l add dumdum up master br0 type dummy\n $ bridge mdb add dev br0 port dumdum grp 239.0.0.1 permanent vid 1\n $ ip link set dev br0 down\n $ ip link set dev br0 type bridge mcast_vlan_snooping 1\n   ^^^^ this will enable snooping, but will not update mdb_n_entries\n        because in __br_multicast_enable_port_ctx() we check !netif_running\n $ bridge mdb flush dev br0\n   ^^^ this will trigger the warning because it will delete the pg which\n       we added above, which will try to decrease mdb_n_entries\n\nFix the problem by removing the conditional increase and always keep the\ncount up-to-date while the vlan exists. In order to do that we have to\nfirst initialize it on port-vlan context creation, and then always increase\nor decrease the value regardless of mcast options. To keep the current\nbehaviour we have to enforce the mdb limit only if the context is port\u0027s or\nif the port-vlan\u0027s mcast snooping is enabled.\n\n[1]\n ------------[ cut here ]------------\n n == 0\n WARNING: net/bridge/br_multicast.c:718 at br_multicast_port_ngroups_dec_one net/bridge/br_multicast.c:718 [inline], CPU#0: syz.4.4607/22043\n WARNING: net/bridge/br_multicast.c:718 at br_multicast_port_ngroups_dec net/bridge/br_multicast.c:771 [inline], CPU#0: syz.4.4607/22043\n WARNING: net/bridge/br_multicast.c:718 at br_multicast_del_pg+0x1bbe/0x1e20 net/bridge/br_multicast.c:825, CPU#0: syz.4.4607/22043\n Modules linked in:\n CPU: 0 UID: 0 PID: 22043 Comm: syz.4.4607 Not tainted syzkaller #0 PREEMPT(full)\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026\n RIP: 0010:br_multicast_port_ngroups_dec_one net/bridge/br_multicast.c:718 [inline]\n RIP: 0010:br_multicast_port_ngroups_dec net/bridge/br_multicast.c:771 [inline]\n RIP: 0010:br_multicast_del_pg+0x1bbe/0x1e20 net/bridge/br_multicast.c:825\n Code: 41 5f 5d e9 04 7a 48 f7 e8 3f 73 5c f7 90 0f 0b 90 e9 cf fd ff ff e8 31 73 5c f7 90 0f 0b 90 e9 16 fd ff ff e8 23 73 5c f7 90 \u003c0f\u003e 0b 90 e9 60 fd ff ff e8 15 73 5c f7 eb 05 e8 0e 73 5c f7 48 8b\n RSP: 0018:ffffc9000c207220 EFLAGS: 00010293\n RAX: ffffffff8a68042d RBX: ffff88807c6f1800 RCX: ffff888066e90000\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n RBP: 0000000000000000 R08: ffff888066e90000 R09: 000000000000000c\n R10: 000000000000000c R11: 0000000000000000 R12: ffff8880303ef800\n R13: dffffc0000000000 R14: ffff888050eb11c4 R15: 1ffff1100a1d6238\n FS:  00007fa45921b6c0(0000) GS:ffff8881256f5000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007fa4591f9ff8 CR3: 0000000081df2000 CR4: 00000000003526f0\n Call Trace:\n  \u003cTASK\u003e\n  br_mdb_flush_pgs net/bridge/br_mdb.c:1525 [inline]\n  br_mdb_flush net/bridge/br_mdb.c:1544 [inline]\n  br_mdb_del_bulk+0x5e2/0xb20 net/bridge/br_mdb.c:1561\n  rtnl_mdb_del+0x48a/0x640 net/core/rtnetlink.c:-1\n  rtnetlink_rcv_msg+0x77e/0xbe0 net/core/rtnetlink.c:6967\n  netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550\n  netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]\n  netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344\n  netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894\n  sock_sendmsg_nosec net/socket.c:727 [inline]\n  __sock_sendmsg net/socket.c:742 [inline]\n  ____sys_sendmsg+0xa68/0xad0 net/socket.c:2592\n  ___sys_sendmsg+0x2a5/0x360 net/socke\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T12:17:28.607Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d0fdad1bdd21a358cc2c85da3681ae27b86ce6ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/724a405ce0309676f1e993c173382b4c4a022beb"
        },
        {
          "url": "https://git.kernel.org/stable/c/fae260fc84e1eae8f590c7907e53e8768df2d986"
        },
        {
          "url": "https://git.kernel.org/stable/c/45525fdfd4cb612d7b414dd5cfa1f43892a7cd71"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b769e311a86bb9d15c5658ad283b86fc8f080a2"
        }
      ],
      "title": "net: bridge: mcast: always update mdb_n_entries for vlan contexts",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45913",
    "datePublished": "2026-05-27T12:17:28.607Z",
    "dateReserved": "2026-05-13T15:03:33.085Z",
    "dateUpdated": "2026-05-27T12:17:28.607Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T13:00:36.620Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/lpc18xx-dmamux.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3d396ebfb3049a2b5fac51d2c967db5114b685e8",
              "status": "affected",
              "version": "e5f4ae84be7421010780984bdc121eac15997327",
              "versionType": "git"
            },
            {
              "lessThan": "499ddae78c4baa9b94df76b2d2eb6b150d15377f",
              "status": "affected",
              "version": "e5f4ae84be7421010780984bdc121eac15997327",
              "versionType": "git"
            },
            {
              "lessThan": "adef147a8d8c3d767abf88ad2c381ffab2993086",
              "status": "affected",
              "version": "e5f4ae84be7421010780984bdc121eac15997327",
              "versionType": "git"
            },
            {
              "lessThan": "9fba97baa520c9446df51a64708daf27c5a7ed32",
              "status": "affected",
              "version": "e5f4ae84be7421010780984bdc121eac15997327",
              "versionType": "git"
            },
            {
              "lessThan": "992eb8055a6e5dbb808672d20d68e60d5a89b12b",
              "status": "affected",
              "version": "e5f4ae84be7421010780984bdc121eac15997327",
              "versionType": "git"
            },
            {
              "lessThan": "1e47d80f6720f0224efd19bcf081d39637569c10",
              "status": "affected",
              "version": "e5f4ae84be7421010780984bdc121eac15997327",
              "versionType": "git"
            },
            {
              "lessThan": "d4d63059dee7e7cae0c4d9a532ed558bc90efb55",
              "status": "affected",
              "version": "e5f4ae84be7421010780984bdc121eac15997327",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/lpc18xx-dmamux.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.3"
            },
            {
              "lessThan": "4.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.249",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.199",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.122",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.67",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.249",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.199",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.162",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.122",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.67",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.7",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: lpc18xx-dmamux: fix device leak on route allocation\n\nMake sure to drop the reference taken when looking up the DMA mux\nplatform device during route allocation.\n\nNote that holding a reference to a device does not prevent its driver\ndata from going away so there is no point in keeping the reference."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:56:22.014Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3d396ebfb3049a2b5fac51d2c967db5114b685e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/499ddae78c4baa9b94df76b2d2eb6b150d15377f"
        },
        {
          "url": "https://git.kernel.org/stable/c/adef147a8d8c3d767abf88ad2c381ffab2993086"
        },
        {
          "url": "https://git.kernel.org/stable/c/9fba97baa520c9446df51a64708daf27c5a7ed32"
        },
        {
          "url": "https://git.kernel.org/stable/c/992eb8055a6e5dbb808672d20d68e60d5a89b12b"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e47d80f6720f0224efd19bcf081d39637569c10"
        },
        {
          "url": "https://git.kernel.org/stable/c/d4d63059dee7e7cae0c4d9a532ed558bc90efb55"
        }
      ],
      "title": "dmaengine: lpc18xx-dmamux: fix device leak on route allocation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71188",
    "datePublished": "2026-01-31T11:41:59.624Z",
    "dateReserved": "2026-01-31T11:36:51.188Z",
    "dateUpdated": "2026-06-02T13:00:36.620Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T13:00:52.214Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/usb/gs_usb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9c151898cc259a7784be60ba38664f42ede39b31",
              "status": "affected",
              "version": "d08e973a77d128b25e01a08c34d89593fdf222da",
              "versionType": "git"
            },
            {
              "lessThan": "ec5ccc2af9e5b045671f3f604b57512feda8bcc5",
              "status": "affected",
              "version": "d08e973a77d128b25e01a08c34d89593fdf222da",
              "versionType": "git"
            },
            {
              "lessThan": "f905bcfa971edb89e398c98957838d8c6381c0c7",
              "status": "affected",
              "version": "d08e973a77d128b25e01a08c34d89593fdf222da",
              "versionType": "git"
            },
            {
              "lessThan": "08624b7206ddb9148eeffc2384ebda2c47b6d1e9",
              "status": "affected",
              "version": "d08e973a77d128b25e01a08c34d89593fdf222da",
              "versionType": "git"
            },
            {
              "lessThan": "9f669a38ca70839229b7ba0f851820850a2fe1f7",
              "status": "affected",
              "version": "d08e973a77d128b25e01a08c34d89593fdf222da",
              "versionType": "git"
            },
            {
              "lessThan": "7352e1d5932a0e777e39fa4b619801191f57e603",
              "status": "affected",
              "version": "d08e973a77d128b25e01a08c34d89593fdf222da",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/usb/gs_usb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.16"
            },
            {
              "lessThan": "3.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.122",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.67",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.162",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.122",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.67",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.7",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak\n\nIn gs_can_open(), the URBs for USB-in transfers are allocated, added to the\nparent-\u003erx_submitted anchor and submitted. In the complete callback\ngs_usb_receive_bulk_callback(), the URB is processed and resubmitted. In\ngs_can_close() the URBs are freed by calling\nusb_kill_anchored_urbs(parent-\u003erx_submitted).\n\nHowever, this does not take into account that the USB framework unanchors\nthe URB before the complete function is called. This means that once an\nin-URB has been completed, it is no longer anchored and is ultimately not\nreleased in gs_can_close().\n\nFix the memory leak by anchoring the URB in the\ngs_usb_receive_bulk_callback() to the parent-\u003erx_submitted anchor."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:58:40.032Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9c151898cc259a7784be60ba38664f42ede39b31"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec5ccc2af9e5b045671f3f604b57512feda8bcc5"
        },
        {
          "url": "https://git.kernel.org/stable/c/f905bcfa971edb89e398c98957838d8c6381c0c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/08624b7206ddb9148eeffc2384ebda2c47b6d1e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f669a38ca70839229b7ba0f851820850a2fe1f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/7352e1d5932a0e777e39fa4b619801191f57e603"
        }
      ],
      "title": "can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23031",
    "datePublished": "2026-01-31T11:42:09.276Z",
    "dateReserved": "2026-01-13T15:37:45.942Z",
    "dateUpdated": "2026-06-02T13:00:52.214Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:47:31.032Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/atm/signaling.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c96549d07dfdd51aadf0722cfb40711574424840",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "1c8bda3df028d5e54134077dcd09f46ca8cfceb5",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "3e1a8b00095246a9a2b46b57f6d471c6d3c00ed2",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "e3f80666c2739296c3b69a127300455c43aa1067",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "21c303fec138c002f90ed33bce60e807d53072bb",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "69d3f9ee5489e6e8b66defcfa226e91d82393297",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "440c9a5fc477a8ee259d8bf669531250b8398651",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "ae88a5d2f29b69819dc7b04086734439d074a643",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/atm/signaling.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.252",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.252",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: atm: fix crash due to unvalidated vcc pointer in sigd_send()\n\nReproducer available at [1].\n\nThe ATM send path (sendmsg -\u003e vcc_sendmsg -\u003e sigd_send) reads the vcc\npointer from msg-\u003evcc and uses it directly without any validation. This\npointer comes from userspace via sendmsg() and can be arbitrarily forged:\n\n    int fd = socket(AF_ATMSVC, SOCK_DGRAM, 0);\n    ioctl(fd, ATMSIGD_CTRL);  // become ATM signaling daemon\n    struct msghdr msg = { .msg_iov = \u0026iov, ... };\n    *(unsigned long *)(buf + 4) = 0xdeadbeef;  // fake vcc pointer\n    sendmsg(fd, \u0026msg, 0);  // kernel dereferences 0xdeadbeef\n\nIn normal operation, the kernel sends the vcc pointer to the signaling\ndaemon via sigd_enq() when processing operations like connect(), bind(),\nor listen(). The daemon is expected to return the same pointer when\nresponding. However, a malicious daemon can send arbitrary pointer values.\n\nFix this by introducing find_get_vcc() which validates the pointer by\nsearching through vcc_hash (similar to how sigd_close() iterates over\nall VCCs), and acquires a reference via sock_hold() if found.\n\nSince struct atm_vcc embeds struct sock as its first member, they share\nthe same lifetime. Therefore using sock_hold/sock_put is sufficient to\nkeep the vcc alive while it is being used.\n\nNote that there may be a race with sigd_close() which could mark the vcc\nwith various flags (e.g., ATM_VF_RELEASED) after find_get_vcc() returns.\nHowever, sock_hold() guarantees the memory remains valid, so this race\nonly affects the logical state, not memory safety.\n\n[1]: https://gist.github.com/mrpre/1ba5949c45529c511152e2f4c755b0f3"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:08:11.432Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c96549d07dfdd51aadf0722cfb40711574424840"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c8bda3df028d5e54134077dcd09f46ca8cfceb5"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e1a8b00095246a9a2b46b57f6d471c6d3c00ed2"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3f80666c2739296c3b69a127300455c43aa1067"
        },
        {
          "url": "https://git.kernel.org/stable/c/21c303fec138c002f90ed33bce60e807d53072bb"
        },
        {
          "url": "https://git.kernel.org/stable/c/69d3f9ee5489e6e8b66defcfa226e91d82393297"
        },
        {
          "url": "https://git.kernel.org/stable/c/440c9a5fc477a8ee259d8bf669531250b8398651"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae88a5d2f29b69819dc7b04086734439d074a643"
        }
      ],
      "title": "net: atm: fix crash due to unvalidated vcc pointer in sigd_send()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31411",
    "datePublished": "2026-04-08T13:06:17.800Z",
    "dateReserved": "2026-03-09T15:48:24.087Z",
    "dateUpdated": "2026-07-14T12:47:31.032Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/mgmt/user_session.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "69674b029002b1d90b655f014bdf64f404efa54d",
              "status": "affected",
              "version": "a4348710a7267705b75692dc1a000920481d1d92",
              "versionType": "git"
            },
            {
              "lessThan": "6b615a8fb3af0baf8126cde3d4fee97d57222ffc",
              "status": "affected",
              "version": "b685757c7b08d5073046fb379be965fd6c06aafc",
              "versionType": "git"
            },
            {
              "lessThan": "5cc679ba0f4505936124cd4179ba66bb0a4bd9f3",
              "status": "affected",
              "version": "b685757c7b08d5073046fb379be965fd6c06aafc",
              "versionType": "git"
            },
            {
              "lessThan": "6bd7e0e55dcea2cf0d391bbc21c2eb069b4be3e1",
              "status": "affected",
              "version": "b685757c7b08d5073046fb379be965fd6c06aafc",
              "versionType": "git"
            },
            {
              "lessThan": "305853cce379407090a73b38c5de5ba748893aee",
              "status": "affected",
              "version": "b685757c7b08d5073046fb379be965fd6c06aafc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1f485b54d04a920723984062c912174330a05178",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "052b41ef2abe274f068e892aee81406f11bd1f3a",
              "versionType": "git"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.145",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/mgmt/user_session.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.123",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.123",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.53",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.3",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.145",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: Fix race condition in RPC handle list access\n\nThe \u0027sess-\u003erpc_handle_list\u0027 XArray manages RPC handles within a ksmbd\nsession. Access to this list is intended to be protected by\n\u0027sess-\u003erpc_lock\u0027 (an rw_semaphore). However, the locking implementation was\nflawed, leading to potential race conditions.\n\nIn ksmbd_session_rpc_open(), the code incorrectly acquired only a read lock\nbefore calling xa_store() and xa_erase(). Since these operations modify\nthe XArray structure, a write lock is required to ensure exclusive access\nand prevent data corruption from concurrent modifications.\n\nFurthermore, ksmbd_session_rpc_method() accessed the list using xa_load()\nwithout holding any lock at all. This could lead to reading inconsistent\ndata or a potential use-after-free if an entry is concurrently removed and\nthe pointer is dereferenced.\n\nFix these issues by:\n1. Using down_write() and up_write() in ksmbd_session_rpc_open()\n   to ensure exclusive access during XArray modification, and ensuring\n   the lock is correctly released on error paths.\n2. Adding down_read() and up_read() in ksmbd_session_rpc_method()\n   to safely protect the lookup."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is in ksmbd, the in-kernel SMB server, and is driven entirely by SMB2 requests (CREATE/CLOSE/IOCTL/READ/WRITE/QUERY_INFO) arriving over TCP port 445 from a remote peer. No local access is needed.\nAC:L - The attacker controls both sides of the race: the pipe handle is an attacker-chosen VolatileFileId, and ksmbd_queue_work() executes each SMB2 request on a separate ksmbd-io worker (plus SMB3 multichannel), so concurrent SMB2_CLOSE and SMB2_IOCTL/READ/WRITE requests run in parallel with unlimited retries.\nPR:L - Reaching create_smb2_pipe() requires a session in SMB2_SESSION_VALID state (ksmbd_session_lookup_all() rejects IN_PROGRESS) plus a tree connect to IPC$, i.e. any valid low-privileged SMB account; no administrative rights are needed, and with guest mapping enabled even credentials are unnecessary.\nUI:N - The entire sequence is performed by the attacker\u0027s own SMB client against the server; no action by any local user or administrator is required.\nS:U - The use-after-free corrupts kernel heap state within the same kernel security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The unlocked xa_load() dereferences a kfree()\u0027d struct ksmbd_session_rpc, disclosing reused kernel heap contents as the RPC method flags; a UAF of this kind gives control over freed-object contents and can be leveraged into arbitrary kernel memory disclosure, and the resulting flags can steer the root ksmbd.mountd daemon into SAMR/LSARPC handlers the client never opened.\nI:H - The stale entry-\u003emethod value read from a reused 8-byte slab object is heap-groomable by the attacker and directly selects which privileged RPC method the root-privileged userspace daemon executes with client-supplied payload; use-after-free conditions are generally leverageable into arbitrary-write and control-flow hijack primitives.\nA:H - Dereferencing the freed entry after the slab object or page has been released oopses the ksmbd worker thread, and the unsynchronized RPC handle teardown corrupts session state, yielding a repeatable remote kernel crash / denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:07:13.052Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/69674b029002b1d90b655f014bdf64f404efa54d"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b615a8fb3af0baf8126cde3d4fee97d57222ffc"
        },
        {
          "url": "https://git.kernel.org/stable/c/5cc679ba0f4505936124cd4179ba66bb0a4bd9f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/6bd7e0e55dcea2cf0d391bbc21c2eb069b4be3e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/305853cce379407090a73b38c5de5ba748893aee"
        }
      ],
      "title": "ksmbd: Fix race condition in RPC handle list access",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40039",
    "datePublished": "2025-10-28T11:48:19.781Z",
    "dateReserved": "2025-04-16T07:20:57.153Z",
    "dateUpdated": "2026-08-05T12:07:13.052Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-38591",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:41:20.077651Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:11.247Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:42:15.421Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/cgroup.c",
            "net/core/filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7847c4140e06f6e87229faae22cc38525334c156",
              "status": "affected",
              "version": "f96da09473b52c09125cc9bf7d7d4576ae8229e0",
              "versionType": "git"
            },
            {
              "lessThan": "feae34c992eb7191862fb1594c704fbbf650fef8",
              "status": "affected",
              "version": "f96da09473b52c09125cc9bf7d7d4576ae8229e0",
              "versionType": "git"
            },
            {
              "lessThan": "33660d44e789edb4f303210c813fc56d56377a90",
              "status": "affected",
              "version": "f96da09473b52c09125cc9bf7d7d4576ae8229e0",
              "versionType": "git"
            },
            {
              "lessThan": "058a0da4f6d916a79b693384111bb80a90d73763",
              "status": "affected",
              "version": "f96da09473b52c09125cc9bf7d7d4576ae8229e0",
              "versionType": "git"
            },
            {
              "lessThan": "202900ceeef67458c964c2af6e1427c8e533ea7c",
              "status": "affected",
              "version": "f96da09473b52c09125cc9bf7d7d4576ae8229e0",
              "versionType": "git"
            },
            {
              "lessThan": "e09299225d5ba3916c91ef70565f7d2187e4cca0",
              "status": "affected",
              "version": "f96da09473b52c09125cc9bf7d7d4576ae8229e0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/cgroup.c",
            "net/core/filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.249",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.199",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.67",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.249",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.199",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.162",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.67",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.1",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject narrower access to pointer ctx fields\n\nThe following BPF program, simplified from a syzkaller repro, causes a\nkernel warning:\n\n    r0 = *(u8 *)(r1 + 169);\n    exit;\n\nWith pointer field sk being at offset 168 in __sk_buff. This access is\ndetected as a narrower read in bpf_skb_is_valid_access because it\ndoesn\u0027t match offsetof(struct __sk_buff, sk). It is therefore allowed\nand later proceeds to bpf_convert_ctx_access. Note that for the\n\"is_narrower_load\" case in the convert_ctx_accesses(), the insn-\u003eoff\nis aligned, so the cnt may not be 0 because it matches the\noffsetof(struct __sk_buff, sk) in the bpf_convert_ctx_access. However,\nthe target_size stays 0 and the verifier errors with a kernel warning:\n\n    verifier bug: error during ctx access conversion(1)\n\nThis patch fixes that to return a proper \"invalid bpf_context access\noff=X size=Y\" error on the load instruction.\n\nThe same issue affects multiple other fields in context structures that\nallow narrow access. Some other non-affected fields (for sk_msg,\nsk_lookup, and sockopt) were also changed to use bpf_ctx_range_ptr for\nconsistency.\n\nNote this syzkaller crash was reported in the \"Closes\" link below, which\nused to be about a different bug, fixed in\ncommit fce7bd8e385a (\"bpf/verifier: Handle BPF_LOAD_ACQ instructions\nin insn_def_regno()\"). Because syzbot somehow confused the two bugs,\nthe new crash and repro didn\u0027t get reported to the mailing list."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:31:12.628Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7847c4140e06f6e87229faae22cc38525334c156"
        },
        {
          "url": "https://git.kernel.org/stable/c/feae34c992eb7191862fb1594c704fbbf650fef8"
        },
        {
          "url": "https://git.kernel.org/stable/c/33660d44e789edb4f303210c813fc56d56377a90"
        },
        {
          "url": "https://git.kernel.org/stable/c/058a0da4f6d916a79b693384111bb80a90d73763"
        },
        {
          "url": "https://git.kernel.org/stable/c/202900ceeef67458c964c2af6e1427c8e533ea7c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e09299225d5ba3916c91ef70565f7d2187e4cca0"
        }
      ],
      "title": "bpf: Reject narrower access to pointer ctx fields",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38591",
    "datePublished": "2025-08-19T17:03:12.508Z",
    "dateReserved": "2025-04-16T04:51:24.026Z",
    "dateUpdated": "2026-07-14T12:42:15.421Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "lib/flex_proportions.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0acc9ba7a1b5ba4d998c5753e709be904e179b75",
              "status": "affected",
              "version": "a91befde350375b1ff954635acdde14dc92cd9a8",
              "versionType": "git"
            },
            {
              "lessThan": "884b2590ffcc7222cbbd6298051f4c243cc36f5d",
              "status": "affected",
              "version": "a91befde350375b1ff954635acdde14dc92cd9a8",
              "versionType": "git"
            },
            {
              "lessThan": "78ede9ebd679dadf480dce6f7b798e3603f88348",
              "status": "affected",
              "version": "a91befde350375b1ff954635acdde14dc92cd9a8",
              "versionType": "git"
            },
            {
              "lessThan": "b91a84299d72ae0e05551e851e47cd3008bd025b",
              "status": "affected",
              "version": "a91befde350375b1ff954635acdde14dc92cd9a8",
              "versionType": "git"
            },
            {
              "lessThan": "dd9e2f5b38f1fdd49b1ab6d3a85f81c14369eacc",
              "status": "affected",
              "version": "a91befde350375b1ff954635acdde14dc92cd9a8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "lib/flex_proportions.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.123",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.69",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.162",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.123",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.69",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.9",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nflex_proportions: make fprop_new_period() hardirq safe\n\nBernd has reported a lockdep splat from flexible proportions code that is\nessentially complaining about the following race:\n\n\u003ctimer fires\u003e\nrun_timer_softirq - we are in softirq context\n  call_timer_fn\n    writeout_period\n      fprop_new_period\n        write_seqcount_begin(\u0026p-\u003esequence);\n\n        \u003chardirq is raised\u003e\n        ...\n        blk_mq_end_request()\n\t  blk_update_request()\n\t    ext4_end_bio()\n\t      folio_end_writeback()\n\t\t__wb_writeout_add()\n\t\t  __fprop_add_percpu_max()\n\t\t    if (unlikely(max_frac \u003c FPROP_FRAC_BASE)) {\n\t\t      fprop_fraction_percpu()\n\t\t\tseq = read_seqcount_begin(\u0026p-\u003esequence);\n\t\t\t  - sees odd sequence so loops indefinitely\n\nNote that a deadlock like this is only possible if the bdi has configured\nmaximum fraction of writeout throughput which is very rare in general but\nfrequent for example for FUSE bdis.  To fix this problem we have to make\nsure write section of the sequence counter is irqsafe."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:01:38.422Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0acc9ba7a1b5ba4d998c5753e709be904e179b75"
        },
        {
          "url": "https://git.kernel.org/stable/c/884b2590ffcc7222cbbd6298051f4c243cc36f5d"
        },
        {
          "url": "https://git.kernel.org/stable/c/78ede9ebd679dadf480dce6f7b798e3603f88348"
        },
        {
          "url": "https://git.kernel.org/stable/c/b91a84299d72ae0e05551e851e47cd3008bd025b"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd9e2f5b38f1fdd49b1ab6d3a85f81c14369eacc"
        }
      ],
      "title": "flex_proportions: make fprop_new_period() hardirq safe",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23168",
    "datePublished": "2026-02-14T16:01:31.465Z",
    "dateReserved": "2026-01-13T15:37:45.981Z",
    "dateUpdated": "2026-05-11T22:01:38.422Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/rds/rdma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "91a44b406bc1f9e1c5da0cb7d0d5991b43b79147",
              "status": "affected",
              "version": "0d4597c8c5abdeeaf50774066c16683f30184dc8",
              "versionType": "git"
            },
            {
              "lessThan": "106dc689206610cfa2098f593fdd1e020c997835",
              "status": "affected",
              "version": "0d4597c8c5abdeeaf50774066c16683f30184dc8",
              "versionType": "git"
            },
            {
              "lessThan": "ec55a86f7fba7d9111df94b9c11a4755ed492995",
              "status": "affected",
              "version": "0d4597c8c5abdeeaf50774066c16683f30184dc8",
              "versionType": "git"
            },
            {
              "lessThan": "8fdbb6262a4a3ed44a0830a7793903b54bb27bdc",
              "status": "affected",
              "version": "0d4597c8c5abdeeaf50774066c16683f30184dc8",
              "versionType": "git"
            },
            {
              "lessThan": "d95cea9298be1ba8876e3f156be96d3a492085ca",
              "status": "affected",
              "version": "0d4597c8c5abdeeaf50774066c16683f30184dc8",
              "versionType": "git"
            },
            {
              "lessThan": "033370ffb3c9c0264d19f8ba9ef769523266589a",
              "status": "affected",
              "version": "0d4597c8c5abdeeaf50774066c16683f30184dc8",
              "versionType": "git"
            },
            {
              "lessThan": "b3cb8cae530b2727d8245684148bb49425f6765c",
              "status": "affected",
              "version": "0d4597c8c5abdeeaf50774066c16683f30184dc8",
              "versionType": "git"
            },
            {
              "lessThan": "8141a2dc70080eda1aedc0389ed2db2b292af5bd",
              "status": "affected",
              "version": "0d4597c8c5abdeeaf50774066c16683f30184dc8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/rds/rdma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.86",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rds: fix MR cleanup on copy error\n\n__rds_rdma_map() hands sg/pages ownership to the transport after\nget_mr() succeeds. If copying the generated cookie back to user space\nfails after that point, the error path must not free those resources\nagain before dropping the MR reference.\n\nRemove the duplicate unpin/free from the put_user() failure branch so\nthat MR teardown is handled only through the existing final cleanup\npath."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is triggered through the local `setsockopt(SOL_RDS, RDS_GET_MR/RDS_GET_MR_FOR_DEST)` syscall on an RDS socket (MR-registration control plane); it is not reachable from a remote peer\u0027s network packets.\nAC:L - Once an RDMA-capable RDS socket is bound, the double-free is 100% deterministic and the attacker fully controls the trigger by supplying a bad `cookie_addr` so `put_user()` faults; there is no race or attacker-uncontrolled condition.\nPR:L - Creating an AF_RDS socket has no capability check (module auto-loads) and `can_do_mlock()` passes for normal users by default, so any unprivileged local user on a host with RDMA hardware can reach the path.\nUI:N - The attacker triggers the entire sequence with its own syscalls; no action by another user or victim is required.\nS:U - The double-free corrupts the kernel slab/page allocator within the kernel\u0027s own security authority and does not cross a virtualization or IOMMU boundary.\nC:H - The double-free of the `sg` slab object and the page-refcount underflow yield use-after-free/cross-object primitives that can be groomed into arbitrary kernel-memory reads, enabling significant information disclosure.\nI:H - A double `kfree()` corrupts the SLUB freelist and the page-refcount underflow allows reuse of an in-use physical page, both classic primitives for arbitrary kernel write and privilege escalation.\nA:H - The double-free and page-refcount underflow readily cause heap corruption, freelist poisoning, and kernel panic/oops."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:29:21.209Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/91a44b406bc1f9e1c5da0cb7d0d5991b43b79147"
        },
        {
          "url": "https://git.kernel.org/stable/c/106dc689206610cfa2098f593fdd1e020c997835"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec55a86f7fba7d9111df94b9c11a4755ed492995"
        },
        {
          "url": "https://git.kernel.org/stable/c/8fdbb6262a4a3ed44a0830a7793903b54bb27bdc"
        },
        {
          "url": "https://git.kernel.org/stable/c/d95cea9298be1ba8876e3f156be96d3a492085ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/033370ffb3c9c0264d19f8ba9ef769523266589a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3cb8cae530b2727d8245684148bb49425f6765c"
        },
        {
          "url": "https://git.kernel.org/stable/c/8141a2dc70080eda1aedc0389ed2db2b292af5bd"
        }
      ],
      "title": "net: rds: fix MR cleanup on copy error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46053",
    "datePublished": "2026-05-27T12:57:11.870Z",
    "dateReserved": "2026-05-13T15:03:33.094Z",
    "dateUpdated": "2026-08-05T12:29:21.209Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/x86/hp/hp-bioscfg/bioscfg.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "eb5ff1025c92117d5d1cc728bcfa294abe484da1",
              "status": "affected",
              "version": "5f94f181ca25d8c5b77beb2da0cb466ddb6ece29",
              "versionType": "git"
            },
            {
              "lessThan": "eba49c1dee9c5e514ca18e52c545bba524e8a045",
              "status": "affected",
              "version": "5f94f181ca25d8c5b77beb2da0cb466ddb6ece29",
              "versionType": "git"
            },
            {
              "lessThan": "193922a23d7294085a47d7719fdb7d66ad0a236f",
              "status": "affected",
              "version": "5f94f181ca25d8c5b77beb2da0cb466ddb6ece29",
              "versionType": "git"
            },
            {
              "lessThan": "25150715e0b049b99df664daf05dab12f41c3e13",
              "status": "affected",
              "version": "5f94f181ca25d8c5b77beb2da0cb466ddb6ece29",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/x86/hp/hp-bioscfg/bioscfg.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.122",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.68",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.122",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.68",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.8",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro\n\nThe GET_INSTANCE_ID macro that caused a kernel panic when accessing sysfs\nattributes:\n\n1. Off-by-one error: The loop condition used \u0027\u003c=\u0027 instead of \u0027\u003c\u0027,\n   causing access beyond array bounds. Since array indices are 0-based\n   and go from 0 to instances_count-1, the loop should use \u0027\u003c\u0027.\n\n2. Missing NULL check: The code dereferenced attr_name_kobj-\u003ename\n   without checking if attr_name_kobj was NULL, causing a null pointer\n   dereference in min_length_show() and other attribute show functions.\n\nThe panic occurred when fwupd tried to read BIOS configuration attributes:\n\n  Oops: general protection fault [#1] SMP KASAN NOPTI\n  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n  RIP: 0010:min_length_show+0xcf/0x1d0 [hp_bioscfg]\n\nAdd a NULL check for attr_name_kobj before dereferencing and corrects\nthe loop boundary to match the pattern used elsewhere in the driver."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:59:15.864Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/eb5ff1025c92117d5d1cc728bcfa294abe484da1"
        },
        {
          "url": "https://git.kernel.org/stable/c/eba49c1dee9c5e514ca18e52c545bba524e8a045"
        },
        {
          "url": "https://git.kernel.org/stable/c/193922a23d7294085a47d7719fdb7d66ad0a236f"
        },
        {
          "url": "https://git.kernel.org/stable/c/25150715e0b049b99df664daf05dab12f41c3e13"
        }
      ],
      "title": "platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23062",
    "datePublished": "2026-02-04T16:07:44.420Z",
    "dateReserved": "2026-01-13T15:37:45.953Z",
    "dateUpdated": "2026-05-11T21:59:15.864Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/erofs/decompressor.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "778acd52e9497806fbd2cea7f770c41d6850fc48",
              "status": "affected",
              "version": "598162d050801e556750defff4ddab499e5d76ed",
              "versionType": "git"
            },
            {
              "lessThan": "118ff71ff09ebaf323a09af9e911517321a299f4",
              "status": "affected",
              "version": "598162d050801e556750defff4ddab499e5d76ed",
              "versionType": "git"
            },
            {
              "lessThan": "43a878639b90e9721ffa5eb616a7e6d8454adef3",
              "status": "affected",
              "version": "598162d050801e556750defff4ddab499e5d76ed",
              "versionType": "git"
            },
            {
              "lessThan": "f1374fa6e57fd836623668d782ded9244cfd2938",
              "status": "affected",
              "version": "598162d050801e556750defff4ddab499e5d76ed",
              "versionType": "git"
            },
            {
              "lessThan": "c9ce18e6bb2c467ec85756dc7989b547b7584fee",
              "status": "affected",
              "version": "598162d050801e556750defff4ddab499e5d76ed",
              "versionType": "git"
            },
            {
              "lessThan": "bbbbb3f0d7864238a8da2a94cd6ec013fee06a2e",
              "status": "affected",
              "version": "598162d050801e556750defff4ddab499e5d76ed",
              "versionType": "git"
            },
            {
              "lessThan": "21e161de2dc660b1bb70ef5b156ab8e6e1cca3ab",
              "status": "affected",
              "version": "598162d050801e556750defff4ddab499e5d76ed",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/erofs/decompressor.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.88",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.30",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()\n\nSome crafted images can have illegal (!partial_decoding \u0026\u0026\nm_llen \u003c m_plen) extents, and the LZ4 inplace decompression path\ncan be wrongly hit, but it cannot handle (outpages \u003c inpages)\nproperly: \"outpages - inpages\" wraps to a large value and\nthe subsequent rq-\u003eout[] access reads past the decompressed_pages\narray.\n\nHowever, such crafted cases can correctly result in a corruption\nreport in the normal LZ4 non-inplace path.\n\nLet\u0027s add an additional check to fix this for backporting.\n\nReproducible image (base64-encoded gzipped blob):\n\nH4sIAJGR12kCA+3SPUoDQRgG4MkmkkZk8QRbRFIIi9hbpEjrHQI5ghfwCN5BLCzTGtLbBI+g\ndilSJo1CnIm7GEXFxhT6PDDwfrs73/ywIQD/1ePD4r7Ou6ETsrq4mu7XcWfj++Pb58nJU/9i\nPNtbjhan04/9GtX4qVYc814WDqt6FaX5s+ZwXXeq52lndT6IuVvlblytLMvh4Gzwaf90nsvz\n2DF/21+20T/ldgp5s1jXRaN4t/8izsy/OUB6e/Qa79r+JwAAAAAAAL52vQVuGQAAAP6+my1w\nywAAAAAAAADwu14ATsEYtgBQAAA=\n\n$ mount -t erofs -o cache_strategy=disabled foo.erofs /mnt\n$ dd if=/mnt/data of=/dev/null bs=4096 count=1"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - EROFS is mounted from a local block device/image file (FS_REQUIRES_DEV, not userns-mountable); triggering requires locally providing a crafted image and reading from it, with no network path.\nAC:L - The attacker fully controls the crafted image (a working base64 reproducer is in the commit); the illegal extent reliably forces outpages\u003cinpages and the underflow on the first read with no race or uncontrolled condition.\nPR:N - Crafting the malicious image requires no privileges or account on the target system; the attacker merely supplies the image, consistent with the analogous crafted-image CVE-2026-43166 (PR:N).\nUI:R - A victim or automount service must mount the attacker-supplied EROFS image and access the file for the decompression path to be reached.\nS:U - The OOB access and resulting crash stay within the kernel\u0027s own security authority; no VM/IOMMU/sandbox boundary is crossed.\nC:H - The unsigned underflow produces an unbounded out-of-bounds read of the page-pointer array far past its end, and in the matching path wild kernel memory can be fed into the decompressed output read by userspace \u2014 per kernel guidance an unbounded OOB read is High.\nI:N - The flaw is strictly a read underflow (\"reads past the decompressed_pages array\"); it yields no out-of-bounds write or control-flow primitive, matching the analogous OOB-read CVE-2026-43166 (I:N).\nA:H - Indexing the array ~32 GB beyond its base dereferences unmapped kernel memory, reliably causing a kernel oops/panic and denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:29:04.993Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/778acd52e9497806fbd2cea7f770c41d6850fc48"
        },
        {
          "url": "https://git.kernel.org/stable/c/118ff71ff09ebaf323a09af9e911517321a299f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/43a878639b90e9721ffa5eb616a7e6d8454adef3"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1374fa6e57fd836623668d782ded9244cfd2938"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9ce18e6bb2c467ec85756dc7989b547b7584fee"
        },
        {
          "url": "https://git.kernel.org/stable/c/bbbbb3f0d7864238a8da2a94cd6ec013fee06a2e"
        },
        {
          "url": "https://git.kernel.org/stable/c/21e161de2dc660b1bb70ef5b156ab8e6e1cca3ab"
        }
      ],
      "title": "erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45999",
    "datePublished": "2026-05-27T12:55:53.846Z",
    "dateReserved": "2026-05-13T15:03:33.091Z",
    "dateUpdated": "2026-08-05T12:29:04.993Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtw88/rtw8822b.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7852ca1cc65ad43fb8b620e6a65d5cb15e4e4487",
              "status": "affected",
              "version": "297bcf8222f222fd7defead862de4b8e3ea0b08a",
              "versionType": "git"
            },
            {
              "lessThan": "a96d161cfdb11cd2c35d5e498b93431164823338",
              "status": "affected",
              "version": "297bcf8222f222fd7defead862de4b8e3ea0b08a",
              "versionType": "git"
            },
            {
              "lessThan": "0d0c2fb80ca4c284c397dd7546743a3b5fdf4020",
              "status": "affected",
              "version": "297bcf8222f222fd7defead862de4b8e3ea0b08a",
              "versionType": "git"
            },
            {
              "lessThan": "509becaee5680a39bde00c2c7d448dfeb39a8e05",
              "status": "affected",
              "version": "297bcf8222f222fd7defead862de4b8e3ea0b08a",
              "versionType": "git"
            },
            {
              "lessThan": "44510ff07b5198e4a835a3074b716cec8357695b",
              "status": "affected",
              "version": "297bcf8222f222fd7defead862de4b8e3ea0b08a",
              "versionType": "git"
            },
            {
              "lessThan": "44d1f624bbdd2d60319374ba85f7195a28d00c90",
              "status": "affected",
              "version": "297bcf8222f222fd7defead862de4b8e3ea0b08a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtw88/rtw8822b.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode()\n\nrtw8822b_set_antenna() can be called from userspace when the chip is\npowered off. In that case a WARNING is triggered in\nrtw8822b_config_trx_mode() because trying to read the RF registers\nwhen the chip is powered off returns an unexpected value.\n\nCall rtw8822b_config_trx_mode() in rtw8822b_set_antenna() only when\nthe chip is powered on.\n\n------------[ cut here ]------------\nwrite RF mode table fail\nWARNING: CPU: 0 PID: 7183 at rtw8822b.c:824 rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b]\nCPU: 0 UID: 0 PID: 7183 Comm: iw Tainted: G        W  OE       6.17.5-arch1-1 #1 PREEMPT(full)  01c39fc421df2af799dd5e9180b572af860b40c1\nTainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\nHardware name: LENOVO 82KR/LNVNB161216, BIOS HBCN18WW 08/27/2021\nRIP: 0010:rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b]\nCall Trace:\n \u003cTASK\u003e\n rtw8822b_set_antenna+0x57/0x70 [rtw88_8822b 370206f42e5890d8d5f48eb358b759efa37c422b]\n rtw_ops_set_antenna+0x50/0x80 [rtw88_core 711c8fb4f686162be4625b1d0b8e8c6a5ac850fb]\n ieee80211_set_antenna+0x60/0x100 [mac80211 f1845d85d2ecacf3b71867635a050ece90486cf3]\n nl80211_set_wiphy+0x384/0xe00 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]\n ? netdev_run_todo+0x63/0x550\n genl_family_rcv_msg_doit+0xfc/0x160\n genl_rcv_msg+0x1aa/0x2b0\n ? __pfx_nl80211_pre_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]\n ? __pfx_nl80211_set_wiphy+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]\n ? __pfx_nl80211_post_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]\n ? __pfx_genl_rcv_msg+0x10/0x10\n netlink_rcv_skb+0x59/0x110\n genl_rcv+0x28/0x40\n netlink_unicast+0x285/0x3c0\n ? __alloc_skb+0xdb/0x1a0\n netlink_sendmsg+0x20d/0x430\n ____sys_sendmsg+0x39f/0x3d0\n ? import_iovec+0x2f/0x40\n ___sys_sendmsg+0x99/0xe0\n ? refill_obj_stock+0x12e/0x240\n __sys_sendmsg+0x8a/0xf0\n do_syscall_64+0x81/0x970\n ? do_syscall_64+0x81/0x970\n ? ksys_read+0x73/0xf0\n ? do_syscall_64+0x81/0x970\n ? count_memcg_events+0xc2/0x190\n ? handle_mm_fault+0x1d7/0x2d0\n ? do_user_addr_fault+0x21a/0x690\n ? exc_page_fault+0x7e/0x1a0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n \u003c/TASK\u003e\n---[ end trace 0000000000000000 ]---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:57:28.537Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7852ca1cc65ad43fb8b620e6a65d5cb15e4e4487"
        },
        {
          "url": "https://git.kernel.org/stable/c/a96d161cfdb11cd2c35d5e498b93431164823338"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d0c2fb80ca4c284c397dd7546743a3b5fdf4020"
        },
        {
          "url": "https://git.kernel.org/stable/c/509becaee5680a39bde00c2c7d448dfeb39a8e05"
        },
        {
          "url": "https://git.kernel.org/stable/c/44510ff07b5198e4a835a3074b716cec8357695b"
        },
        {
          "url": "https://git.kernel.org/stable/c/44d1f624bbdd2d60319374ba85f7195a28d00c90"
        }
      ],
      "title": "wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71297",
    "datePublished": "2026-05-08T13:11:09.120Z",
    "dateReserved": "2026-05-06T11:31:45.510Z",
    "dateUpdated": "2026-05-11T21:57:28.537Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/uverbs_cmd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9c15ec4cd4e7f57c6bbcb4e73e99290f150dd2a7",
              "status": "affected",
              "version": "c3bea3d2dc5358e05541527283279102383b0231",
              "versionType": "git"
            },
            {
              "lessThan": "9b5ac1c15334d46c0dbd49d64a2257b929500163",
              "status": "affected",
              "version": "c3bea3d2dc5358e05541527283279102383b0231",
              "versionType": "git"
            },
            {
              "lessThan": "01c9b152647dc70dc06a4a2eff86ebb3b3c76075",
              "status": "affected",
              "version": "c3bea3d2dc5358e05541527283279102383b0231",
              "versionType": "git"
            },
            {
              "lessThan": "bf1feed1a7886af945f92890493aefd2b5c9928a",
              "status": "affected",
              "version": "c3bea3d2dc5358e05541527283279102383b0231",
              "versionType": "git"
            },
            {
              "lessThan": "d533425ac1f2925b4fc3e4ed9b9d72362cb23475",
              "status": "affected",
              "version": "c3bea3d2dc5358e05541527283279102383b0231",
              "versionType": "git"
            },
            {
              "lessThan": "bf4454da8b1e712714628c0a0d6e7845bb40790a",
              "status": "affected",
              "version": "c3bea3d2dc5358e05541527283279102383b0231",
              "versionType": "git"
            },
            {
              "lessThan": "bef70ff9841990658610512b4a18e4a88c9b4df6",
              "status": "affected",
              "version": "c3bea3d2dc5358e05541527283279102383b0231",
              "versionType": "git"
            },
            {
              "lessThan": "1956f0a74ccf5dc9c3ef717f2985c3ed3400aab0",
              "status": "affected",
              "version": "c3bea3d2dc5358e05541527283279102383b0231",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/uverbs_cmd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.0"
            },
            {
              "lessThan": "5.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.252",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.252",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send\n\nib_uverbs_post_send() uses cmd.wqe_size from userspace without any\nvalidation before passing it to kmalloc() and using the allocated\nbuffer as struct ib_uverbs_send_wr.\n\nIf a user provides a small wqe_size value (e.g., 1), kmalloc() will\nsucceed, but subsequent accesses to user_wr-\u003eopcode, user_wr-\u003enum_sge,\nand other fields will read beyond the allocated buffer, resulting in\nan out-of-bounds read from kernel heap memory. This could potentially\nleak sensitive kernel information to userspace.\n\nAdditionally, providing an excessively large wqe_size can trigger a\nWARNING in the memory allocation path, as reported by syzkaller.\n\nThis is inconsistent with ib_uverbs_unmarshall_recv() which properly\nvalidates that wqe_size \u003e= sizeof(struct ib_uverbs_recv_wr) before\nproceeding.\n\nAdd the same validation for ib_uverbs_post_send() to ensure wqe_size\nis at least sizeof(struct ib_uverbs_send_wr)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached via write() on the local RDMA uverbs character device (/dev/infiniband/uverbs*) dispatched through UAPI_DEF_WRITE_IO; it is not reachable over any network.\nAC:L - The attacker fully controls cmd.wqe_size and can reliably trigger the OOB read by simply setting wqe_size=1 (or the WARN with a huge value); no uncontrolled conditions are involved.\nPR:L - An unprivileged local user with access to the RDMA uverbs device (the normal case on RDMA-enabled systems, and obtainable via Soft-RoCE) can open a context, create a QP, and issue POST_SEND; no real-root privilege is required.\nUI:N - The command is issued directly by the attacker via a syscall; no action by any other user is needed.\nS:U - The OOB read and resulting impact remain within the kernel\u0027s own security authority; no crossing of a security boundary (VM/IOMMU/sandbox) occurs.\nC:H - The bug reads ~48 bytes of kernel heap memory beyond the undersized allocation, and the leaked values (e.g. wr_id) are returned to userspace via completion polling, giving a repeatable kernel-heap information disclosure.\nI:N - The defect is purely an out-of-bounds read; num_sge is bounded by the sge_count check, so no kernel memory is modified and there is no write primitive.\nA:H - An excessively large wqe_size triggers a WARNING in the allocator (syzkaller-reported), which becomes a kernel panic under the common panic_on_warn hardening, causing denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:28:29.851Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9c15ec4cd4e7f57c6bbcb4e73e99290f150dd2a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b5ac1c15334d46c0dbd49d64a2257b929500163"
        },
        {
          "url": "https://git.kernel.org/stable/c/01c9b152647dc70dc06a4a2eff86ebb3b3c76075"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf1feed1a7886af945f92890493aefd2b5c9928a"
        },
        {
          "url": "https://git.kernel.org/stable/c/d533425ac1f2925b4fc3e4ed9b9d72362cb23475"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf4454da8b1e712714628c0a0d6e7845bb40790a"
        },
        {
          "url": "https://git.kernel.org/stable/c/bef70ff9841990658610512b4a18e4a88c9b4df6"
        },
        {
          "url": "https://git.kernel.org/stable/c/1956f0a74ccf5dc9c3ef717f2985c3ed3400aab0"
        }
      ],
      "title": "RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45856",
    "datePublished": "2026-05-27T12:15:33.209Z",
    "dateReserved": "2026-05-13T15:03:33.079Z",
    "dateUpdated": "2026-08-05T12:28:29.851Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/mgmt/user_session.c",
            "fs/smb/server/mgmt/user_session.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a4348710a7267705b75692dc1a000920481d1d92",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "1067361a1cc6ad9cdf7acfc47f90012b72ad1502",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "8fb3b6c85b7e3127161623586b62abcc366caa20",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "6323fec65fe54b365961fed260dd579191e46121",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            },
            {
              "lessThan": "a1f46c99d9ea411f9bf30025b912d881d36fc709",
              "status": "affected",
              "version": "0626e6641f6b467447c81dd7678a69c66f7746cf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/mgmt/user_session.c",
            "fs/smb/server/mgmt/user_session.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.122",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.28",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.162",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.122",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.28",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.6",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free in ksmbd_session_rpc_open\n\nA UAF issue can occur due to a race condition between\nksmbd_session_rpc_open() and __session_rpc_close().\nAdd rpc_lock to the session to protect it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ksmbd is the in-kernel SMB server listening on TCP/445; the entire attack consists of SMB2 CREATE and CLOSE PDUs sent over the network to the IPC$ share. No local access is needed at any point.\nAC:L - The attacker drives both sides of the race by pipelining concurrent SMB2 requests on one connection (ksmbd\u0027s workqueue has no per-connection serialization), and the race window spans a blocking userspace IPC round-trip of up to 2 seconds, while the target handle ID is a predictable small `ida_alloc()` value.\nPR:L - Reaching create_smb2_pipe() requires a completed SMB2 SESSION_SETUP and a TREE_CONNECT to IPC$, i.e. any valid low-privileged SMB account (or a guest account where mapping is enabled). This matches the scoring of the sibling ksmbd session UAFs CVE-2025-22040/CVE-2025-22041.\nUI:N - The attacker generates every request in the sequence; no action by a legitimate user or administrator is required to trigger the race.\nS:U - The corruption is confined to the kernel\u0027s own heap and the ksmbd server\u0027s data structures, all within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The success path returns `entry-\u003eid` read from freed slab memory and sends it back to the attacker as the CREATE response VolatileFileId, directly leaking reclaimed kernel heap contents, and the UAF/double-free of a small generic-cache object gives a spray-controlled read primitive.\nI:H - The error path double-frees the entry and calls ksmbd_rpc_id_free() on a stale IDA id now owned by a different live RPC handle, yielding freelist corruption and cross-handle aliasing that are classic stepping stones to arbitrary write and control-flow hijack in kernel context.\nA:H - Use-after-free and double-free of a kmalloc object reliably produce slab corruption, oops, or panic, and the attacker can repeat the race indefinitely over new sessions to crash the server."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:58:26.156Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a4348710a7267705b75692dc1a000920481d1d92"
        },
        {
          "url": "https://git.kernel.org/stable/c/1067361a1cc6ad9cdf7acfc47f90012b72ad1502"
        },
        {
          "url": "https://git.kernel.org/stable/c/8fb3b6c85b7e3127161623586b62abcc366caa20"
        },
        {
          "url": "https://git.kernel.org/stable/c/6323fec65fe54b365961fed260dd579191e46121"
        },
        {
          "url": "https://git.kernel.org/stable/c/a1f46c99d9ea411f9bf30025b912d881d36fc709"
        }
      ],
      "title": "ksmbd: fix use-after-free in ksmbd_session_rpc_open",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37926",
    "datePublished": "2025-05-20T15:21:53.359Z",
    "dateReserved": "2025-04-16T04:51:23.969Z",
    "dateUpdated": "2026-08-05T11:58:26.156Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/rt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d57d0746276a88ea43a2cc62b849fd8a95e32e41",
              "status": "affected",
              "version": "4bdced5c9a2922521e325896a7bbbf0132c94e56",
              "versionType": "git"
            },
            {
              "lessThan": "3b3c672a66db3de3b40f8a7057864bc1f874ede3",
              "status": "affected",
              "version": "4bdced5c9a2922521e325896a7bbbf0132c94e56",
              "versionType": "git"
            },
            {
              "lessThan": "16ca9f3117e9a294646c897daf08a5ab546c711b",
              "status": "affected",
              "version": "4bdced5c9a2922521e325896a7bbbf0132c94e56",
              "versionType": "git"
            },
            {
              "lessThan": "8ad5577b2d4acfd83f03d97a0aece2d18aac5f07",
              "status": "affected",
              "version": "4bdced5c9a2922521e325896a7bbbf0132c94e56",
              "versionType": "git"
            },
            {
              "lessThan": "a6a73403733e86748421f2eeaf028c85683ef896",
              "status": "affected",
              "version": "4bdced5c9a2922521e325896a7bbbf0132c94e56",
              "versionType": "git"
            },
            {
              "lessThan": "52aeb1e07ec223caf212f036817976c98d2aa250",
              "status": "affected",
              "version": "4bdced5c9a2922521e325896a7bbbf0132c94e56",
              "versionType": "git"
            },
            {
              "lessThan": "9f25edc5a20cb52a5abbf25f0724bb4732b81801",
              "status": "affected",
              "version": "4bdced5c9a2922521e325896a7bbbf0132c94e56",
              "versionType": "git"
            },
            {
              "lessThan": "94894c9c477e53bcea052e075c53f89df3d2a33e",
              "status": "affected",
              "version": "4bdced5c9a2922521e325896a7bbbf0132c94e56",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cb1831a83e54cd3269a2420fce81c4fd8ae6f667",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1c37ff78298a6b6063649123356a312e1cce12ca",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f17c786b28a3060a566a170c2cf3bd7441fc30a3",
              "versionType": "git"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.103",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.66",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/sched/rt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.252",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.252",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.103",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.66",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/rt: Skip currently executing CPU in rto_next_cpu()\n\nCPU0 becomes overloaded when hosting a CPU-bound RT task, a non-CPU-bound\nRT task, and a CFS task stuck in kernel space. When other CPUs switch from\nRT to non-RT tasks, RT load balancing (LB) is triggered; with\nHAVE_RT_PUSH_IPI enabled, they send IPIs to CPU0 to drive the execution\nof rto_push_irq_work_func. During push_rt_task on CPU0,\nif next_task-\u003eprio \u003c rq-\u003edonor-\u003eprio, resched_curr() sets NEED_RESCHED\nand after the push operation completes, CPU0 calls rto_next_cpu().\nSince only CPU0 is overloaded in this scenario, rto_next_cpu() should\nideally return -1 (no further IPI needed).\n\nHowever, multiple CPUs invoking tell_cpu_to_push() during LB increments\nrd-\u003erto_loop_next. Even when rd-\u003erto_cpu is set to -1, the mismatch between\nrd-\u003erto_loop and rd-\u003erto_loop_next forces rto_next_cpu() to restart its\nsearch from -1. With CPU0 remaining overloaded (satisfying rt_nr_migratory\n\u0026\u0026 rt_nr_total \u003e 1), it gets reselected, causing CPU0 to queue irq_work to\nitself and send self-IPIs repeatedly. As long as CPU0 stays overloaded and\nother CPUs run pull_rt_tasks(), it falls into an infinite self-IPI loop,\nwhich triggers a CPU hardlockup due to continuous self-interrupts.\n\nThe trigging scenario is as follows:\n\n         cpu0                      cpu1                    cpu2\n                                pull_rt_task\n                              tell_cpu_to_push\n                 \u003c------------irq_work_queue_on\nrto_push_irq_work_func\n       push_rt_task\n    resched_curr(rq)                                   pull_rt_task\n    rto_next_cpu                                     tell_cpu_to_push\n                      \u003c-------------------------- atomic_inc(rto_loop_next)\nrd-\u003erto_loop != next\n     rto_next_cpu\n   irq_work_queue_on\nrto_push_irq_work_func\n\nFix redundant self-IPI by filtering the initiating CPU in rto_next_cpu().\nThis solution has been verified to effectively eliminate spurious self-IPIs\nand prevent CPU hardlockup scenarios."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T12:17:37.165Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d57d0746276a88ea43a2cc62b849fd8a95e32e41"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b3c672a66db3de3b40f8a7057864bc1f874ede3"
        },
        {
          "url": "https://git.kernel.org/stable/c/16ca9f3117e9a294646c897daf08a5ab546c711b"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ad5577b2d4acfd83f03d97a0aece2d18aac5f07"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6a73403733e86748421f2eeaf028c85683ef896"
        },
        {
          "url": "https://git.kernel.org/stable/c/52aeb1e07ec223caf212f036817976c98d2aa250"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f25edc5a20cb52a5abbf25f0724bb4732b81801"
        },
        {
          "url": "https://git.kernel.org/stable/c/94894c9c477e53bcea052e075c53f89df3d2a33e"
        }
      ],
      "title": "sched/rt: Skip currently executing CPU in rto_next_cpu()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45919",
    "datePublished": "2026-05-27T12:17:37.165Z",
    "dateReserved": "2026-05-13T15:03:33.085Z",
    "dateUpdated": "2026-05-27T12:17:37.165Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/gfs2/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5d5d9ec957bfa1eb2b05861c19f5d701dd006db7",
              "status": "affected",
              "version": "e9079cce201784632aed4b1a3121ee38c1ced0b6",
              "versionType": "git"
            },
            {
              "lessThan": "cead3bebf3e318578b8a86a5472015d713d2a8a8",
              "status": "affected",
              "version": "e9079cce201784632aed4b1a3121ee38c1ced0b6",
              "versionType": "git"
            },
            {
              "lessThan": "e428670cfb2993d8c224effd076242ca6b0950de",
              "status": "affected",
              "version": "e9079cce201784632aed4b1a3121ee38c1ced0b6",
              "versionType": "git"
            },
            {
              "lessThan": "5d2c4f182ea8516de8682e2b60411c03df00e3ea",
              "status": "affected",
              "version": "e9079cce201784632aed4b1a3121ee38c1ced0b6",
              "versionType": "git"
            },
            {
              "lessThan": "2e121c53b581e40397ae08090a7af4ed10781fbc",
              "status": "affected",
              "version": "e9079cce201784632aed4b1a3121ee38c1ced0b6",
              "versionType": "git"
            },
            {
              "lessThan": "9d15fee888f0e8938c9aeed71ec9c2cbba0c88ab",
              "status": "affected",
              "version": "e9079cce201784632aed4b1a3121ee38c1ced0b6",
              "versionType": "git"
            },
            {
              "lessThan": "e411d74cc5ba290f85d0dd5e4d1df8f1d6d975d2",
              "status": "affected",
              "version": "e9079cce201784632aed4b1a3121ee38c1ced0b6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/gfs2/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.29"
            },
            {
              "lessThan": "2.6.29",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: fiemap page fault fix\n\nIn gfs2_fiemap(), we are calling iomap_fiemap() while holding the inode\nglock.  This can lead to recursive glock taking if the fiemap buffer is\nmemory mapped to the same inode and accessing it triggers a page fault.\n\nFix by disabling page faults for iomap_fiemap() and faulting in the\nbuffer by hand if necessary.\n\nFixes xfstest generic/742."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:21:09.600Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5d5d9ec957bfa1eb2b05861c19f5d701dd006db7"
        },
        {
          "url": "https://git.kernel.org/stable/c/cead3bebf3e318578b8a86a5472015d713d2a8a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/e428670cfb2993d8c224effd076242ca6b0950de"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d2c4f182ea8516de8682e2b60411c03df00e3ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e121c53b581e40397ae08090a7af4ed10781fbc"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d15fee888f0e8938c9aeed71ec9c2cbba0c88ab"
        },
        {
          "url": "https://git.kernel.org/stable/c/e411d74cc5ba290f85d0dd5e4d1df8f1d6d975d2"
        }
      ],
      "title": "gfs2: fiemap page fault fix",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43262",
    "datePublished": "2026-05-06T11:28:49.480Z",
    "dateReserved": "2026-05-01T14:12:55.997Z",
    "dateUpdated": "2026-05-11T22:21:09.600Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/phy/st/phy-stm32-usbphyc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a9eec890879731c280697fdf1c50699e905b2fa7",
              "status": "affected",
              "version": "94c358da3a0545205c6c6a50ae26141f1c73acfa",
              "versionType": "git"
            },
            {
              "lessThan": "fb9d513cdf1614bf0f0e785816afb1faae3f81af",
              "status": "affected",
              "version": "94c358da3a0545205c6c6a50ae26141f1c73acfa",
              "versionType": "git"
            },
            {
              "lessThan": "c06f13876cbad702582cd67fc77356e5524d02cd",
              "status": "affected",
              "version": "94c358da3a0545205c6c6a50ae26141f1c73acfa",
              "versionType": "git"
            },
            {
              "lessThan": "76b870fdaad82171a24b8aacffe5e4d9e0d2ee2c",
              "status": "affected",
              "version": "94c358da3a0545205c6c6a50ae26141f1c73acfa",
              "versionType": "git"
            },
            {
              "lessThan": "b91c9f6bfb04e430adeeac7e7ebc9d80f9d72bad",
              "status": "affected",
              "version": "94c358da3a0545205c6c6a50ae26141f1c73acfa",
              "versionType": "git"
            },
            {
              "lessThan": "7c27eaf183563b86d815ff6e9cca0210b4cfa051",
              "status": "affected",
              "version": "94c358da3a0545205c6c6a50ae26141f1c73acfa",
              "versionType": "git"
            },
            {
              "lessThan": "cabd25b57216ddc132efbcc31f972baa03aad15a",
              "status": "affected",
              "version": "94c358da3a0545205c6c6a50ae26141f1c73acfa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/phy/st/phy-stm32-usbphyc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.249",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.199",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.122",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.67",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.249",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.199",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.162",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.122",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.67",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.7",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nphy: stm32-usphyc: Fix off by one in probe()\n\nThe \"index\" variable is used as an index into the usbphyc-\u003ephys[] array\nwhich has usbphyc-\u003enphys elements.  So if it is equal to usbphyc-\u003enphys\nthen it is one element out of bounds.  The \"index\" comes from the\ndevice tree so it\u0027s data that we trust and it\u0027s unlikely to be wrong,\nhowever it\u0027s obviously still worth fixing the bug.  Change the \u003e to \u003e=."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:56:31.172Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a9eec890879731c280697fdf1c50699e905b2fa7"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb9d513cdf1614bf0f0e785816afb1faae3f81af"
        },
        {
          "url": "https://git.kernel.org/stable/c/c06f13876cbad702582cd67fc77356e5524d02cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/76b870fdaad82171a24b8aacffe5e4d9e0d2ee2c"
        },
        {
          "url": "https://git.kernel.org/stable/c/b91c9f6bfb04e430adeeac7e7ebc9d80f9d72bad"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c27eaf183563b86d815ff6e9cca0210b4cfa051"
        },
        {
          "url": "https://git.kernel.org/stable/c/cabd25b57216ddc132efbcc31f972baa03aad15a"
        }
      ],
      "title": "phy: stm32-usphyc: Fix off by one in probe()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71196",
    "datePublished": "2026-02-04T16:04:17.141Z",
    "dateReserved": "2026-01-31T11:36:51.191Z",
    "dateUpdated": "2026-05-11T21:56:31.172Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mscc/ocelot_net.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0b217a40156f497e09dd20d3f7baec40c785f386",
              "status": "affected",
              "version": "960ec92774e152b677ccd0006abcab7b9dd814c2",
              "versionType": "git"
            },
            {
              "lessThan": "cc1b179f778f98270bdbbb48d183b4b6427ae198",
              "status": "affected",
              "version": "e83b49ecb569c9c5fa7cc30e55cf2c15f71f9f39",
              "versionType": "git"
            },
            {
              "lessThan": "7ac58d8832802ec89baa7539e13e6d58a88cce04",
              "status": "affected",
              "version": "c5e12ac3beb0dd3a718296b2d8af5528e9ab728e",
              "versionType": "git"
            },
            {
              "lessThan": "51c32ae7fae14552d79f7139614b77c1bbd57a48",
              "status": "affected",
              "version": "c5e12ac3beb0dd3a718296b2d8af5528e9ab728e",
              "versionType": "git"
            },
            {
              "lessThan": "63da961381e0d979459dede713001f8452364477",
              "status": "affected",
              "version": "c5e12ac3beb0dd3a718296b2d8af5528e9ab728e",
              "versionType": "git"
            },
            {
              "lessThan": "026f6513c5880c2c89e38ad66bbec2868f978605",
              "status": "affected",
              "version": "c5e12ac3beb0dd3a718296b2d8af5528e9ab728e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "609cd73bf38bbd48f1e695e01802114b01aa8811",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.165",
              "status": "affected",
              "version": "6.1.107",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.128",
              "status": "affected",
              "version": "6.6.48",
              "versionType": "semver"
            },
            {
              "lessThan": "6.11",
              "status": "affected",
              "version": "6.10.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mscc/ocelot_net.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "6.1.107",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "6.6.48",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj()\n\nocelot_port_xmit_inj() calls ocelot_can_inject() and\nocelot_port_inject_frame() without holding the injection group lock.\nBoth functions contain lockdep_assert_held() for the injection lock,\nand the correct caller felix_port_deferred_xmit() properly acquires\nthe lock using ocelot_lock_inj_grp() before calling these functions.\n\nAdd ocelot_lock_inj_grp()/ocelot_unlock_inj_grp() around the register\ninjection path to fix the missing lock protection. The FDMA path is not\naffected as it uses its own locking mechanism."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T12:15:15.494Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0b217a40156f497e09dd20d3f7baec40c785f386"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc1b179f778f98270bdbbb48d183b4b6427ae198"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ac58d8832802ec89baa7539e13e6d58a88cce04"
        },
        {
          "url": "https://git.kernel.org/stable/c/51c32ae7fae14552d79f7139614b77c1bbd57a48"
        },
        {
          "url": "https://git.kernel.org/stable/c/63da961381e0d979459dede713001f8452364477"
        },
        {
          "url": "https://git.kernel.org/stable/c/026f6513c5880c2c89e38ad66bbec2868f978605"
        }
      ],
      "title": "net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45849",
    "datePublished": "2026-05-27T12:15:15.494Z",
    "dateReserved": "2026-05-13T15:03:33.078Z",
    "dateUpdated": "2026-05-27T12:15:15.494Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/rxrpc/key.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "44714dfda386884919ba366411880b6fb3c3efd3",
              "status": "affected",
              "version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247",
              "versionType": "git"
            },
            {
              "lessThan": "41a117dd80371343babc52198d1114e83eb37627",
              "status": "affected",
              "version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247",
              "versionType": "git"
            },
            {
              "lessThan": "9a397aa9b5e53ca63d4d6aefb542832eca389618",
              "status": "affected",
              "version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247",
              "versionType": "git"
            },
            {
              "lessThan": "1fa36cf495b0023e8475d038535c05e4063211e1",
              "status": "affected",
              "version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247",
              "versionType": "git"
            },
            {
              "lessThan": "4458757c020592a3094366e0fb20457383b42f92",
              "status": "affected",
              "version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247",
              "versionType": "git"
            },
            {
              "lessThan": "ce383ba615339f8eaec646a166d2c2b015bb5ca0",
              "status": "affected",
              "version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247",
              "versionType": "git"
            },
            {
              "lessThan": "a1be1c9ece26cea69654f28b255ff9a7906b897b",
              "status": "affected",
              "version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247",
              "versionType": "git"
            },
            {
              "lessThan": "ac33733b10b484d666f97688561670afd5861383",
              "status": "affected",
              "version": "8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/rxrpc/key.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.17"
            },
            {
              "lessThan": "3.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.84",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.25",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.136",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.84",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.25",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.2",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix missing validation of ticket length in non-XDR key preparsing\n\nIn rxrpc_preparse(), there are two paths for parsing key payloads: the\nXDR path (for large payloads) and the non-XDR path (for payloads \u003c= 28\nbytes). While the XDR path (rxrpc_preparse_xdr_rxkad()) correctly\nvalidates the ticket length against AFSTOKEN_RK_TIX_MAX, the non-XDR\npath fails to do so.\n\nThis allows an unprivileged user to provide a very large ticket length.\nWhen this key is later read via rxrpc_read(), the total\ntoken size (toksize) calculation results in a value that exceeds\nAFSTOKEN_LENGTH_MAX, triggering a WARN_ON().\n\n[ 2001.302904] WARNING: CPU: 2 PID: 2108 at net/rxrpc/key.c:778 rxrpc_read+0x109/0x5c0 [rxrpc]\n\nFix this by adding a check in the non-XDR parsing path of rxrpc_preparse()\nto ensure the ticket length does not exceed AFSTOKEN_RK_TIX_MAX,\nbringing it into parity with the XDR parsing logic."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-14T17:43:27.449Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/44714dfda386884919ba366411880b6fb3c3efd3"
        },
        {
          "url": "https://git.kernel.org/stable/c/41a117dd80371343babc52198d1114e83eb37627"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a397aa9b5e53ca63d4d6aefb542832eca389618"
        },
        {
          "url": "https://git.kernel.org/stable/c/1fa36cf495b0023e8475d038535c05e4063211e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/4458757c020592a3094366e0fb20457383b42f92"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce383ba615339f8eaec646a166d2c2b015bb5ca0"
        },
        {
          "url": "https://git.kernel.org/stable/c/a1be1c9ece26cea69654f28b255ff9a7906b897b"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac33733b10b484d666f97688561670afd5861383"
        }
      ],
      "title": "rxrpc: Fix missing validation of ticket length in non-XDR key preparsing",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31696",
    "datePublished": "2026-05-01T13:55:57.485Z",
    "dateReserved": "2026-03-09T15:48:24.131Z",
    "dateUpdated": "2026-06-14T17:43:27.449Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/display/drm_dp_mst_topology.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "95dbd525efce2a9e9e1c50ad15213de644c85ad0",
              "status": "affected",
              "version": "4d07b0bc403403438d9cf88450506240c5faf92f",
              "versionType": "git"
            },
            {
              "lessThan": "ac9a7c329a5610051fc476644c9b9145a5965ecb",
              "status": "affected",
              "version": "4d07b0bc403403438d9cf88450506240c5faf92f",
              "versionType": "git"
            },
            {
              "lessThan": "3f44cdb5371faf225af37d5caba8f21ec0572469",
              "status": "affected",
              "version": "4d07b0bc403403438d9cf88450506240c5faf92f",
              "versionType": "git"
            },
            {
              "lessThan": "4d2ccdea18b564e3f73e3e543854acea64e6277d",
              "status": "affected",
              "version": "4d07b0bc403403438d9cf88450506240c5faf92f",
              "versionType": "git"
            },
            {
              "lessThan": "d6afc7539ce06dadfa5b4787b3cfe79b95d8f67a",
              "status": "affected",
              "version": "4d07b0bc403403438d9cf88450506240c5faf92f",
              "versionType": "git"
            },
            {
              "lessThan": "342ccffd9f77fc29fe1c05fd145e4d842bd2feaa",
              "status": "affected",
              "version": "4d07b0bc403403438d9cf88450506240c5faf92f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/display/drm_dp_mst_topology.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/display/dp_mst: Add protection against 0 vcpi\n\nWhen releasing a timeslot there is a slight chance we may end up\nwith the wrong payload mask due to overflow if the delayed_destroy_work\nends up coming into play after a DP 2.1 monitor gets disconnected\nwhich causes vcpi to become 0 then we try to make the payload =\n~BIT(vcpi - 1) which is a negative shift. VCPI id should never\nreally be 0 hence skip changing the payload mask if VCPI is 0.\n\nOtherwise it leads to\n\u003c7\u003e [515.287237] xe 0000:03:00.0: [drm:drm_dp_mst_get_port_malloc\n[drm_display_helper]] port ffff888126ce9000 (3)\n\u003c4\u003e [515.287267] -----------[ cut here ]-----------\n\u003c3\u003e [515.287268] UBSAN: shift-out-of-bounds in\n../drivers/gpu/drm/display/drm_dp_mst_topology.c:4575:36\n\u003c3\u003e [515.287271] shift exponent -1 is negative\n\u003c4\u003e [515.287275] CPU: 7 UID: 0 PID: 3108 Comm: kworker/u64:33 Tainted: G\nS U 6.17.0-rc6-lgci-xe-xe-3795-3e79699fa1b216e92+ #1 PREEMPT(voluntary)\n\u003c4\u003e [515.287279] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER\n\u003c4\u003e [515.287279] Hardware name: ASUS System Product Name/PRIME Z790-P\nWIFI, BIOS 1645 03/15/2024\n\u003c4\u003e [515.287281] Workqueue: drm_dp_mst_wq drm_dp_delayed_destroy_work\n[drm_display_helper]\n\u003c4\u003e [515.287303] Call Trace:\n\u003c4\u003e [515.287304] \u003cTASK\u003e\n\u003c4\u003e [515.287306] dump_stack_lvl+0xc1/0xf0\n\u003c4\u003e [515.287313] dump_stack+0x10/0x20\n\u003c4\u003e [515.287316] __ubsan_handle_shift_out_of_bounds+0x133/0x2e0\n\u003c4\u003e [515.287324] ? drm_atomic_get_private_obj_state+0x186/0x1d0\n\u003c4\u003e [515.287333] drm_dp_atomic_release_time_slots.cold+0x17/0x3d\n[drm_display_helper]\n\u003c4\u003e [515.287355] mst_connector_atomic_check+0x159/0x180 [xe]\n\u003c4\u003e [515.287546] drm_atomic_helper_check_modeset+0x4d9/0xfa0\n\u003c4\u003e [515.287550] ? __ww_mutex_lock.constprop.0+0x6f/0x1a60\n\u003c4\u003e [515.287562] intel_atomic_check+0x119/0x2b80 [xe]\n\u003c4\u003e [515.287740] ? find_held_lock+0x31/0x90\n\u003c4\u003e [515.287747] ? lock_release+0xce/0x2a0\n\u003c4\u003e [515.287754] drm_atomic_check_only+0x6a2/0xb40\n\u003c4\u003e [515.287758] ? drm_atomic_add_affected_connectors+0x12b/0x140\n\u003c4\u003e [515.287765] drm_atomic_commit+0x6e/0xf0\n\u003c4\u003e [515.287766] ? _pfx__drm_printfn_info+0x10/0x10\n\u003c4\u003e [515.287774] drm_client_modeset_commit_atomic+0x25c/0x2b0\n\u003c4\u003e [515.287794] drm_client_modeset_commit_locked+0x60/0x1b0\n\u003c4\u003e [515.287795] ? mutex_lock_nested+0x1b/0x30\n\u003c4\u003e [515.287801] drm_client_modeset_commit+0x26/0x50\n\u003c4\u003e [515.287804] __drm_fb_helper_restore_fbdev_mode_unlocked+0xdc/0x110\n\u003c4\u003e [515.287810] drm_fb_helper_hotplug_event+0x120/0x140\n\u003c4\u003e [515.287814] drm_fbdev_client_hotplug+0x28/0xd0\n\u003c4\u003e [515.287819] drm_client_hotplug+0x6c/0xf0\n\u003c4\u003e [515.287824] drm_client_dev_hotplug+0x9e/0xd0\n\u003c4\u003e [515.287829] drm_kms_helper_hotplug_event+0x1a/0x30\n\u003c4\u003e [515.287834] drm_dp_delayed_destroy_work+0x3df/0x410\n[drm_display_helper]\n\u003c4\u003e [515.287861] process_one_work+0x22b/0x6f0\n\u003c4\u003e [515.287874] worker_thread+0x1e8/0x3d0\n\u003c4\u003e [515.287879] ? __pfx_worker_thread+0x10/0x10\n\u003c4\u003e [515.287882] kthread+0x11c/0x250\n\u003c4\u003e [515.287886] ? __pfx_kthread+0x10/0x10\n\u003c4\u003e [515.287890] ret_from_fork+0x2d7/0x310\n\u003c4\u003e [515.287894] ? __pfx_kthread+0x10/0x10\n\u003c4\u003e [515.287897] ret_from_fork_asm+0x1a/0x30"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-30T10:41:38.273Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/95dbd525efce2a9e9e1c50ad15213de644c85ad0"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac9a7c329a5610051fc476644c9b9145a5965ecb"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f44cdb5371faf225af37d5caba8f21ec0572469"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d2ccdea18b564e3f73e3e543854acea64e6277d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d6afc7539ce06dadfa5b4787b3cfe79b95d8f67a"
        },
        {
          "url": "https://git.kernel.org/stable/c/342ccffd9f77fc29fe1c05fd145e4d842bd2feaa"
        }
      ],
      "title": "drm/display/dp_mst: Add protection against 0 vcpi",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71305",
    "datePublished": "2026-05-27T12:14:55.722Z",
    "dateReserved": "2026-05-08T13:14:33.087Z",
    "dateUpdated": "2026-05-30T10:41:38.273Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/rxrpc/rxgk_app.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "293095ef618818852bac5488c1bc223935e2ca17",
              "status": "affected",
              "version": "64863f4ca4945bdb62ce2b30823f39ea9fe95415",
              "versionType": "git"
            },
            {
              "lessThan": "c52803e925604e2a17962ab0c99dce2d3f7238db",
              "status": "affected",
              "version": "64863f4ca4945bdb62ce2b30823f39ea9fe95415",
              "versionType": "git"
            },
            {
              "lessThan": "3476c8bb960f48e49355d6f93fb7673211e0163f",
              "status": "affected",
              "version": "64863f4ca4945bdb62ce2b30823f39ea9fe95415",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8ac99c57029e13ebb5fb0d634925abedef32b53a",
              "versionType": "git"
            },
            {
              "lessThan": "6.17",
              "status": "affected",
              "version": "6.16.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/rxrpc/rxgk_app.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.16.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix error handling in rxgk_extract_token()\n\nFix a missing bit of error handling in rxgk_extract_token(): in the event\nthat rxgk_decrypt_skb() returns -ENOMEM, it should just return that rather\nthan continuing on (for anything else, it generates an abort)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - rxrpc is a UDP-based network protocol; the bug is in server-side processing of an RxGK RESPONSE packet received from a remote peer, fully reachable over the network.\nAC:H - The vulnerable fall-through is reachable only when the crypto decrypt path returns -ENOMEM (a kernel allocation failure); for all other errors the code correctly aborts, and an attacker cannot reliably force this allocation to fail.\nPR:N - This runs during the RxGK security challenge/response handshake, before the peer is authenticated, so no privileges or credentials are required.\nUI:N - The server processes incoming RESPONSE packets automatically; no victim interaction is needed.\nS:U - Impact is confined to the kernel\u0027s own security authority; no VM/IOMMU/sandbox boundary is crossed.\nC:H - Skipping decryption causes the server to accept un-authenticated, attacker-supplied ticket data, letting the attacker control K0/identity/level and impersonate a principal, exposing data served over the authenticated session.\nI:H - The attacker-chosen token sets the connection\u0027s session key, security level, and identity without possessing the server key, an authentication bypass that lets the attacker establish a session with forged integrity-relevant parameters.\nA:H - Operating on un-decrypted cryptographic state corrupts the handshake and tears down the connection, and under sustained memory pressure an unauthenticated peer can repeatedly disrupt the RxGK service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:29:07.239Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/293095ef618818852bac5488c1bc223935e2ca17"
        },
        {
          "url": "https://git.kernel.org/stable/c/c52803e925604e2a17962ab0c99dce2d3f7238db"
        },
        {
          "url": "https://git.kernel.org/stable/c/3476c8bb960f48e49355d6f93fb7673211e0163f"
        }
      ],
      "title": "rxrpc: Fix error handling in rxgk_extract_token()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46010",
    "datePublished": "2026-05-27T12:56:11.456Z",
    "dateReserved": "2026-05-13T15:03:33.092Z",
    "dateUpdated": "2026-08-05T12:29:07.239Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:45:45.853Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/addrconf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6e89d60b4f03014f7d412ce64b17a840840d490e",
              "status": "affected",
              "version": "ca97dd10424860a3806ad3a9e26b9dce2901ee0c",
              "versionType": "git"
            },
            {
              "lessThan": "9356b69d03d0f50cce91cebdabd33dda023fbd64",
              "status": "affected",
              "version": "836deb96383ed9c1a411f172954d74b3f74ec6ac",
              "versionType": "git"
            },
            {
              "lessThan": "2684610a9c9c53f262fd864fa5c407e79f304804",
              "status": "affected",
              "version": "cb74207ef98317f8874a0b9780bb339c2eb700b0",
              "versionType": "git"
            },
            {
              "lessThan": "8b6dcb565e419846bd521e31d5e1f98e4d0e1179",
              "status": "affected",
              "version": "00b5b7aab9e422d00d5a9d03d7e0760a76b5d57f",
              "versionType": "git"
            },
            {
              "lessThan": "ddf96c393a33aef4887e2e406c76c2f8cda1419c",
              "status": "affected",
              "version": "00b5b7aab9e422d00d5a9d03d7e0760a76b5d57f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "851b3bb105c595cc20b8dcc1b4de029061ce2b76",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.162",
              "status": "affected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.122",
              "status": "affected",
              "version": "6.6.64",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.67",
              "status": "affected",
              "version": "6.12.2",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12",
              "status": "affected",
              "version": "6.11.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/addrconf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.122",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.67",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.162",
                  "versionStartIncluding": "6.1.120",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.122",
                  "versionStartIncluding": "6.6.64",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.67",
                  "versionStartIncluding": "6.12.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.7",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.11.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: Fix use-after-free in inet6_addr_del().\n\nsyzbot reported use-after-free of inet6_ifaddr in\ninet6_addr_del(). [0]\n\nThe cited commit accidentally moved ipv6_del_addr() for\nmngtmpaddr before reading its ifp-\u003eflags for temporary\naddresses in inet6_addr_del().\n\nLet\u0027s move ipv6_del_addr() down to fix the UAF.\n\n[0]:\nBUG: KASAN: slab-use-after-free in inet6_addr_del.constprop.0+0x67a/0x6b0 net/ipv6/addrconf.c:3117\nRead of size 4 at addr ffff88807b89c86c by task syz.3.1618/9593\n\nCPU: 0 UID: 0 PID: 9593 Comm: syz.3.1618 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xcd/0x630 mm/kasan/report.c:482\n kasan_report+0xe0/0x110 mm/kasan/report.c:595\n inet6_addr_del.constprop.0+0x67a/0x6b0 net/ipv6/addrconf.c:3117\n addrconf_del_ifaddr+0x11e/0x190 net/ipv6/addrconf.c:3181\n inet6_ioctl+0x1e5/0x2b0 net/ipv6/af_inet6.c:582\n sock_do_ioctl+0x118/0x280 net/socket.c:1254\n sock_ioctl+0x227/0x6b0 net/socket.c:1375\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f164cf8f749\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f164de64038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 00007f164d1e5fa0 RCX: 00007f164cf8f749\nRDX: 0000200000000000 RSI: 0000000000008936 RDI: 0000000000000003\nRBP: 00007f164d013f91 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007f164d1e6038 R14: 00007f164d1e5fa0 R15: 00007ffde15c8288\n \u003c/TASK\u003e\n\nAllocated by task 9593:\n kasan_save_stack+0x33/0x60 mm/kasan/common.c:56\n kasan_save_track+0x14/0x30 mm/kasan/common.c:77\n poison_kmalloc_redzone mm/kasan/common.c:397 [inline]\n __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:414\n kmalloc_noprof include/linux/slab.h:957 [inline]\n kzalloc_noprof include/linux/slab.h:1094 [inline]\n ipv6_add_addr+0x4e3/0x2010 net/ipv6/addrconf.c:1120\n inet6_addr_add+0x256/0x9b0 net/ipv6/addrconf.c:3050\n addrconf_add_ifaddr+0x1fc/0x450 net/ipv6/addrconf.c:3160\n inet6_ioctl+0x103/0x2b0 net/ipv6/af_inet6.c:580\n sock_do_ioctl+0x118/0x280 net/socket.c:1254\n sock_ioctl+0x227/0x6b0 net/socket.c:1375\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 6099:\n kasan_save_stack+0x33/0x60 mm/kasan/common.c:56\n kasan_save_track+0x14/0x30 mm/kasan/common.c:77\n kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:584\n poison_slab_object mm/kasan/common.c:252 [inline]\n __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:284\n kasan_slab_free include/linux/kasan.h:234 [inline]\n slab_free_hook mm/slub.c:2540 [inline]\n slab_free_freelist_hook mm/slub.c:2569 [inline]\n slab_free_bulk mm/slub.c:6696 [inline]\n kmem_cache_free_bulk mm/slub.c:7383 [inline]\n kmem_cache_free_bulk+0x2bf/0x680 mm/slub.c:7362\n kfree_bulk include/linux/slab.h:830 [inline]\n kvfree_rcu_bulk+0x1b7/0x1e0 mm/slab_common.c:1523\n kvfree_rcu_drain_ready mm/slab_common.c:1728 [inline]\n kfree_rcu_monitor+0x1d0/0x2f0 mm/slab_common.c:1801\n process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257\n process_scheduled_works kernel/workqu\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable `inet6_addr_del()` path is reached through local IPv6 address-management interfaces, including `ioctl(SIOCDIFADDR)` on an IPv6 socket and rtnetlink `RTM_DELADDR`, not by processing remote packets.\nAC:L - An attacker who can manage addresses in a network namespace can create/delete the relevant IPv6 address state and repeatedly trigger the UAF; the RCU/freeing timing is attacker-influenced enough to be treated as low complexity.\nPR:L - The path is gated by `CAP_NET_ADMIN` in the target network namespace, but this is reachable by an unprivileged local user via user/network namespaces on systems permitting them, so it is low privileges rather than high.\nUI:N - No victim action is needed once the attacker has local execution; the attacker directly issues the ioctl or netlink requests.\nS:U - The impact remains within the kernel security authority of the local system and does not cross a separate scope such as a VM or device isolation boundary.\nC:H - This is a use-after-free of a kernel heap `inet6_ifaddr` object; under the required kernel scoring guidance, UAF memory corruption is treated as enabling high confidentiality impact.\nI:H - Use-after-free of a reclaimable kernel object can be targeted with heap manipulation and is treated as potentially enabling control-flow or data corruption, so integrity impact is high.\nA:H - The bug is KASAN-confirmed as a slab use-after-free in kernel address deletion and can cause kernel oops/panic or repeated crashes."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:20:07.746Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6e89d60b4f03014f7d412ce64b17a840840d490e"
        },
        {
          "url": "https://git.kernel.org/stable/c/9356b69d03d0f50cce91cebdabd33dda023fbd64"
        },
        {
          "url": "https://git.kernel.org/stable/c/2684610a9c9c53f262fd864fa5c407e79f304804"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b6dcb565e419846bd521e31d5e1f98e4d0e1179"
        },
        {
          "url": "https://git.kernel.org/stable/c/ddf96c393a33aef4887e2e406c76c2f8cda1419c"
        }
      ],
      "title": "ipv6: Fix use-after-free in inet6_addr_del().",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23010",
    "datePublished": "2026-01-25T14:36:23.593Z",
    "dateReserved": "2026-01-13T15:37:45.939Z",
    "dateUpdated": "2026-08-05T12:20:07.746Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/namei.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a76c1cad4e80a9802ef8048662255417e3ce5b79",
              "status": "affected",
              "version": "7525dec4b34c80b3015c3f2ac143fd2bfc1febc3",
              "versionType": "git"
            },
            {
              "lessThan": "c78206dcb912ab60b8ee3cbe8c48d749a9a12e1e",
              "status": "affected",
              "version": "40b2d55e045222dd6de2a54a299f682e0f954b03",
              "versionType": "git"
            },
            {
              "lessThan": "047c0aef6af37a2a35181aa085c616ad286386f1",
              "status": "affected",
              "version": "40b2d55e045222dd6de2a54a299f682e0f954b03",
              "versionType": "git"
            },
            {
              "lessThan": "369eb2016d8e2f01931b3bad1cb9cefa83f44003",
              "status": "affected",
              "version": "40b2d55e045222dd6de2a54a299f682e0f954b03",
              "versionType": "git"
            },
            {
              "lessThan": "3cf11e6f36c170050c12171dd6fd3142711478fc",
              "status": "affected",
              "version": "40b2d55e045222dd6de2a54a299f682e0f954b03",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1d1b89c9846e6a550eca3d2ce9323fb591e4f321",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "64582cc5357cd984724cfb0835b4a34d9c279d31",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.136",
              "status": "affected",
              "version": "6.6.23",
              "versionType": "semver"
            },
            {
              "lessThan": "6.8",
              "status": "affected",
              "version": "6.7.11",
              "versionType": "semver"
            },
            {
              "lessThan": "6.9",
              "status": "affected",
              "version": "6.8.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/f2fs/namei.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.84",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.25",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.136",
                  "versionStartIncluding": "6.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.84",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.25",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.2",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.8.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid memory leak in f2fs_rename()\n\nsyzbot reported a f2fs bug as below:\n\nBUG: memory leak\nunreferenced object 0xffff888127f70830 (size 16):\n  comm \"syz.0.23\", pid 6144, jiffies 4294943712\n  hex dump (first 16 bytes):\n    3c af 57 72 5b e6 8f ad 6e 8e fd 33 42 39 03 ff  \u003c.Wr[...n..3B9..\n  backtrace (crc 925f8a80):\n    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]\n    slab_post_alloc_hook mm/slub.c:4520 [inline]\n    slab_alloc_node mm/slub.c:4844 [inline]\n    __do_kmalloc_node mm/slub.c:5237 [inline]\n    __kmalloc_noprof+0x3bd/0x560 mm/slub.c:5250\n    kmalloc_noprof include/linux/slab.h:954 [inline]\n    fscrypt_setup_filename+0x15e/0x3b0 fs/crypto/fname.c:364\n    f2fs_setup_filename+0x52/0xb0 fs/f2fs/dir.c:143\n    f2fs_rename+0x159/0xca0 fs/f2fs/namei.c:961\n    f2fs_rename2+0xd5/0xf20 fs/f2fs/namei.c:1308\n    vfs_rename+0x7ff/0x1250 fs/namei.c:6026\n    filename_renameat2+0x4f4/0x660 fs/namei.c:6144\n    __do_sys_renameat2 fs/namei.c:6173 [inline]\n    __se_sys_renameat2 fs/namei.c:6168 [inline]\n    __x64_sys_renameat2+0x59/0x80 fs/namei.c:6168\n    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n    do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94\n    entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThe root cause is in commit 40b2d55e0452 (\"f2fs: fix to create selinux\nlabel during whiteout initialization\"), we added a call to\nf2fs_setup_filename() without a matching call to f2fs_free_filename(),\nfix it."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-14T17:44:19.741Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a76c1cad4e80a9802ef8048662255417e3ce5b79"
        },
        {
          "url": "https://git.kernel.org/stable/c/c78206dcb912ab60b8ee3cbe8c48d749a9a12e1e"
        },
        {
          "url": "https://git.kernel.org/stable/c/047c0aef6af37a2a35181aa085c616ad286386f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/369eb2016d8e2f01931b3bad1cb9cefa83f44003"
        },
        {
          "url": "https://git.kernel.org/stable/c/3cf11e6f36c170050c12171dd6fd3142711478fc"
        }
      ],
      "title": "f2fs: fix to avoid memory leak in f2fs_rename()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31714",
    "datePublished": "2026-05-01T13:56:09.925Z",
    "dateReserved": "2026-03-09T15:48:24.133Z",
    "dateUpdated": "2026-06-14T17:44:19.741Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.139.1.rt7.480.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-553.139.1.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.199.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_eus_long_life:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-372.199.1.el8_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.159.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-477.159.1.el8_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9",
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-687.17.1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.186.1.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2::nfv"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-284.186.1.rt14.471.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-427.136.1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.14.0-570.127.1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "unknown",
            "packageName": "libkrun",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unknown",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_nvidia:"
            ],
            "defaultStatus": "unknown",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux for NVIDIA 26",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift/ose-rhel-coreos-9",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-27T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s GFS2 filesystem. This memory corruption vulnerability, a use-after-free, occurs in the iomap inline data write path. The issue arises because a data buffer is released prematurely while still being referenced, leading to a write to freed memory. This could allow a local attacker to cause system instability or a denial of service (DoS)."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-826",
                "description": "Premature Release of Resource During Expected Lifetime",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T12:05:56.726Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-45984"
          },
          {
            "name": "RHBZ#2481922",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481922"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45984.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:51603"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36767"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:38902"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27789"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59143"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33743"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59146"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35894"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:55444"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59142"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59147"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59145"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59148"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59149"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36049"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:51604"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:51603: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36767: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:38902: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27789: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59143: Red Hat Enterprise Linux BaseOS (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33743: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59146: Red Hat Enterprise Linux BaseOS (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35894: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:55444: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59142: Red Hat Enterprise Linux BaseOS E4S (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59147: Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59145: Red Hat Enterprise Linux BaseOS E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59148: Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59149: Red Hat Enterprise Linux BaseOS (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36049: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:51604: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-27T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-27T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: gfs2: Fix use-after-free in iomap inline data write path",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/gfs2/bmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1403989d1b502f4a2c0d0b42ccf1c25748442eff",
              "status": "affected",
              "version": "d0a22a4b03b8475b7aa3fa41243c26c291407844",
              "versionType": "git"
            },
            {
              "lessThan": "1cae1bafdf9caa9b462b19af06b1a06902e4e142",
              "status": "affected",
              "version": "d0a22a4b03b8475b7aa3fa41243c26c291407844",
              "versionType": "git"
            },
            {
              "lessThan": "764c3c84b5683e608f43735c803a5f415046686c",
              "status": "affected",
              "version": "d0a22a4b03b8475b7aa3fa41243c26c291407844",
              "versionType": "git"
            },
            {
              "lessThan": "d87268326b277af3665237ac76a73dd9fa8e21b4",
              "status": "affected",
              "version": "d0a22a4b03b8475b7aa3fa41243c26c291407844",
              "versionType": "git"
            },
            {
              "lessThan": "87d4954b5c59735a99ea98cb208d47130f6dce7d",
              "status": "affected",
              "version": "d0a22a4b03b8475b7aa3fa41243c26c291407844",
              "versionType": "git"
            },
            {
              "lessThan": "6d76febba07c40bcf358f63216d36ea68cf1c215",
              "status": "affected",
              "version": "d0a22a4b03b8475b7aa3fa41243c26c291407844",
              "versionType": "git"
            },
            {
              "lessThan": "815ddd27c0c7171a99fe802fdb19098ddef8b19d",
              "status": "affected",
              "version": "d0a22a4b03b8475b7aa3fa41243c26c291407844",
              "versionType": "git"
            },
            {
              "lessThan": "faddeb848305e79db89ee0479bb0e33380656321",
              "status": "affected",
              "version": "d0a22a4b03b8475b7aa3fa41243c26c291407844",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/gfs2/bmap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.252",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.252",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix use-after-free in iomap inline data write path\n\nThe inline data buffer head (dibh) is being released prematurely in\ngfs2_iomap_begin() via release_metapath() while iomap-\u003einline_data\nstill points to dibh-\u003eb_data. This causes a use-after-free when\niomap_write_end_inline() later attempts to write to the inline data\narea.\n\nThe bug sequence:\n1. gfs2_iomap_begin() calls gfs2_meta_inode_buffer() to read inode\n   metadata into dibh\n2. Sets iomap-\u003einline_data = dibh-\u003eb_data + sizeof(struct gfs2_dinode)\n3. Calls release_metapath() which calls brelse(dibh), dropping refcount\n   to 0\n4. kswapd reclaims the page (~39ms later in the syzbot report)\n5. iomap_write_end_inline() tries to memcpy() to iomap-\u003einline_data\n6. KASAN detects use-after-free write to freed memory\n\nFix by storing dibh in iomap-\u003eprivate and incrementing its refcount\nwith get_bh() in gfs2_iomap_begin(). The buffer is then properly\nreleased in gfs2_iomap_end() after the inline write completes,\nensuring the page stays alive for the entire iomap operation.\n\nNote: A C reproducer is not available for this issue. The fix is based\non analysis of the KASAN report and code review showing the buffer head\nis freed before use.\n\n[agruenba: Take buffer head reference in gfs2_iomap_begin() to avoid\nleaks in gfs2_iomap_get() and gfs2_iomap_alloc().]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is reached only through the local write() syscall path (gfs2_file_write_iter \u2192 iomap_file_buffered_write \u2192 gfs2_iomap_begin) on a locally-mounted GFS2 filesystem; it is not exposed to any network protocol.\nAC:L - The bug triggers when the freed dibh page is reclaimed before the inline memcpy; this memory-reclaim window is attacker-influenceable through memory pressure and by stalling copy_from_iter, and per UAF guidance such races are Low.\nPR:L - Triggering only requires writing a small amount of data to a stuffed file on an already-mounted GFS2 filesystem, achievable by a basic unprivileged local user with write access to any file.\nUI:N - The attacker performs the write themselves; in the normal scenario of an already-mounted GFS2 cluster filesystem no separate victim action is required.\nS:U - The corruption stays within the kernel\u0027s own memory and security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - A use-after-free gives the attacker control over the contents of the freed/reallocated page, which per kernel UAF guidance can be leveraged toward arbitrary kernel memory disclosure.\nI:H - The UAF performs a memcpy of attacker-controlled file data into a freed and potentially reallocated kernel page, enabling corruption of adjacent kernel objects and an arbitrary-write primitive.\nA:H - Writing into freed memory corrupts kernel state and reliably causes an oops/panic, as evidenced by the KASAN use-after-free report."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:29:01.790Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1403989d1b502f4a2c0d0b42ccf1c25748442eff"
        },
        {
          "url": "https://git.kernel.org/stable/c/1cae1bafdf9caa9b462b19af06b1a06902e4e142"
        },
        {
          "url": "https://git.kernel.org/stable/c/764c3c84b5683e608f43735c803a5f415046686c"
        },
        {
          "url": "https://git.kernel.org/stable/c/d87268326b277af3665237ac76a73dd9fa8e21b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/87d4954b5c59735a99ea98cb208d47130f6dce7d"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d76febba07c40bcf358f63216d36ea68cf1c215"
        },
        {
          "url": "https://git.kernel.org/stable/c/815ddd27c0c7171a99fe802fdb19098ddef8b19d"
        },
        {
          "url": "https://git.kernel.org/stable/c/faddeb848305e79db89ee0479bb0e33380656321"
        }
      ],
      "title": "gfs2: Fix use-after-free in iomap inline data write path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45984",
    "datePublished": "2026-05-27T12:18:42.964Z",
    "dateReserved": "2026-05-13T15:03:33.090Z",
    "dateUpdated": "2026-08-25T12:05:56.726Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}