Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-0866
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans Microsoft Azure Linux. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | Azure Linux | azl3 kernel 6.6.139.1-1 versions antérieures à 6.6.143.1-1 | ||
| Microsoft | Azure Linux | azl3 nginx 1.28.3-6 versions antérieures à 1.28.3-7 | ||
| Microsoft | Azure Linux | azl3 libreswan 4.15-1 versions antérieures à 4.15-2 | ||
| Microsoft | Azure Linux | azl3 libarchive 3.7.7-6 versions antérieures à 3.7.7-7 | ||
| Microsoft | Azure Linux | azl3 libtiff 4.6.0-13 versions antérieures à 4.6.0-14 |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "azl3 kernel 6.6.139.1-1 versions ant\u00e9rieures \u00e0 6.6.143.1-1",
"product": {
"name": "Azure Linux",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 nginx 1.28.3-6 versions ant\u00e9rieures \u00e0 1.28.3-7",
"product": {
"name": "Azure Linux",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 libreswan 4.15-1 versions ant\u00e9rieures \u00e0 4.15-2",
"product": {
"name": "Azure Linux",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 libarchive 3.7.7-6 versions ant\u00e9rieures \u00e0 3.7.7-7",
"product": {
"name": "Azure Linux",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 libtiff 4.6.0-13 versions ant\u00e9rieures \u00e0 4.6.0-14",
"product": {
"name": "Azure Linux",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-53349",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53349"
},
{
"name": "CVE-2026-52925",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52925"
},
{
"name": "CVE-2026-52968",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52968"
},
{
"name": "CVE-2026-53061",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53061"
},
{
"name": "CVE-2026-53002",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53002"
},
{
"name": "CVE-2026-53287",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53287"
},
{
"name": "CVE-2026-53128",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53128"
},
{
"name": "CVE-2026-53066",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53066"
},
{
"name": "CVE-2026-52970",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52970"
},
{
"name": "CVE-2026-52958",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52958"
},
{
"name": "CVE-2026-52999",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52999"
},
{
"name": "CVE-2026-52989",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52989"
},
{
"name": "CVE-2026-53291",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53291"
},
{
"name": "CVE-2026-52963",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52963"
},
{
"name": "CVE-2026-52993",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52993"
},
{
"name": "CVE-2026-53071",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53071"
},
{
"name": "CVE-2026-53013",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53013"
},
{
"name": "CVE-2026-53064",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53064"
},
{
"name": "CVE-2026-53058",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53058"
},
{
"name": "CVE-2026-53094",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53094"
},
{
"name": "CVE-2026-53047",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53047"
},
{
"name": "CVE-2026-53006",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53006"
},
{
"name": "CVE-2026-14164",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14164"
},
{
"name": "CVE-2026-52975",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52975"
},
{
"name": "CVE-2026-53050",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53050"
},
{
"name": "CVE-2026-42055",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42055"
},
{
"name": "CVE-2026-53021",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53021"
},
{
"name": "CVE-2026-53353",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53353"
},
{
"name": "CVE-2026-53110",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53110"
},
{
"name": "CVE-2026-53329",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53329"
},
{
"name": "CVE-2026-52984",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52984"
},
{
"name": "CVE-2026-53088",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53088"
},
{
"name": "CVE-2026-12413",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12413"
},
{
"name": "CVE-2026-53034",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53034"
},
{
"name": "CVE-2026-53111",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53111"
},
{
"name": "CVE-2026-53112",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53112"
},
{
"name": "CVE-2026-53086",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53086"
},
{
"name": "CVE-2026-52981",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52981"
},
{
"name": "CVE-2026-53060",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53060"
},
{
"name": "CVE-2026-53096",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53096"
},
{
"name": "CVE-2026-53076",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53076"
},
{
"name": "CVE-2026-52908",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52908"
},
{
"name": "CVE-2026-53035",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53035"
},
{
"name": "CVE-2026-53314",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53314"
},
{
"name": "CVE-2026-53347",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53347"
},
{
"name": "CVE-2026-53126",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53126"
},
{
"name": "CVE-2026-52985",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52985"
},
{
"name": "CVE-2026-53059",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53059"
},
{
"name": "CVE-2026-53012",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53012"
},
{
"name": "CVE-2026-53356",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53356"
},
{
"name": "CVE-2026-53073",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53073"
},
{
"name": "CVE-2026-50722",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50722"
},
{
"name": "CVE-2026-53293",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53293"
},
{
"name": "CVE-2026-52910",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52910"
},
{
"name": "CVE-2026-53337",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53337"
},
{
"name": "CVE-2026-50721",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50721"
},
{
"name": "CVE-2026-53289",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53289"
},
{
"name": "CVE-2026-53304",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53304"
},
{
"name": "CVE-2026-52936",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52936"
},
{
"name": "CVE-2026-53223",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53223"
},
{
"name": "CVE-2026-52998",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52998"
},
{
"name": "CVE-2026-53011",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53011"
},
{
"name": "CVE-2026-52920",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52920"
},
{
"name": "CVE-2026-53295",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53295"
},
{
"name": "CVE-2026-53269",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53269"
},
{
"name": "CVE-2026-53357",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53357"
},
{
"name": "CVE-2026-53003",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53003"
},
{
"name": "CVE-2026-53355",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53355"
},
{
"name": "CVE-2026-52986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52986"
},
{
"name": "CVE-2026-53077",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53077"
},
{
"name": "CVE-2026-53056",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53056"
},
{
"name": "CVE-2026-53023",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53023"
},
{
"name": "CVE-2026-12912",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12912"
},
{
"name": "CVE-2026-53063",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53063"
},
{
"name": "CVE-2026-53093",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53093"
},
{
"name": "CVE-2026-53075",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53075"
},
{
"name": "CVE-2026-53352",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53352"
},
{
"name": "CVE-2026-53037",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53037"
},
{
"name": "CVE-2026-53072",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53072"
},
{
"name": "CVE-2026-53068",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53068"
},
{
"name": "CVE-2026-52967",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52967"
},
{
"name": "CVE-2026-52974",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52974"
},
{
"name": "CVE-2026-52933",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52933"
},
{
"name": "CVE-2026-52969",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52969"
},
{
"name": "CVE-2026-53062",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53062"
},
{
"name": "CVE-2026-53032",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53032"
},
{
"name": "CVE-2026-53343",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53343"
},
{
"name": "CVE-2026-53082",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53082"
},
{
"name": "CVE-2026-52977",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52977"
},
{
"name": "CVE-2026-52972",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52972"
},
{
"name": "CVE-2026-53074",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53074"
},
{
"name": "CVE-2026-53036",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53036"
},
{
"name": "CVE-2026-52982",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52982"
},
{
"name": "CVE-2026-53022",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53022"
}
],
"initial_release_date": "2026-07-10T00:00:00",
"last_revision_date": "2026-07-10T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0866",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-07-10T00:00:00.000000"
}
],
"risks": [
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Microsoft Azure Linux. Elles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Azure Linux",
"vendor_advisories": [
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53061",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53061"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53032",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53032"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-52982",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-52982"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-52981",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-52981"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53064",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53064"
},
{
"published_at": "2026-07-04",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53223",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53223"
},
{
"published_at": "2026-06-28",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53291",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53291"
},
{
"published_at": "2026-06-28",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53304",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53304"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-52998",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-52998"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53128",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53128"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53068",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53068"
},
{
"published_at": "2026-06-28",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53293",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53293"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53096",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53096"
},
{
"published_at": "2026-07-04",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-50722",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50722"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-52977",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-52977"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-52920",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-52920"
},
{
"published_at": "2026-07-04",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-12413",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-12413"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53034",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53034"
},
{
"published_at": "2026-07-04",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-50721",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50721"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53021",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53021"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53036",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53036"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53012",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53012"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-52974",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-52974"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53066",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53066"
},
{
"published_at": "2026-06-28",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53289",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53289"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-52993",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-52993"
},
{
"published_at": "2026-06-29",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-52908",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-52908"
},
{
"published_at": "2026-07-02",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53356",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53356"
},
{
"published_at": "2026-07-09",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53269",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53269"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53062",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53062"
},
{
"published_at": "2026-07-02",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53343",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53343"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-52925",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-52925"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53023"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-52936",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-52936"
},
{
"published_at": "2026-06-28",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53295",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53295"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53093",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53093"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-52970",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-52970"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53094",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53094"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-52985",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-52985"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53060",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53060"
},
{
"published_at": "2026-07-02",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53349",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53349"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53112",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53112"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53075",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53075"
},
{
"published_at": "2026-07-02",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53337",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53337"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53011",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53011"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53006",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53006"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53076",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53076"
},
{
"published_at": "2026-07-02",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53352",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53352"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-52986",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-52986"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-52984",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-52984"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-52969",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-52969"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53056",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53056"
},
{
"published_at": "2026-06-28",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53287",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53287"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53074",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53074"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53050",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53050"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53072",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53072"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-52967",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-52967"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53003",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53003"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53047",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53047"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-52975",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-52975"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53059",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53059"
},
{
"published_at": "2026-07-02",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53347",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53347"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53037",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53037"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53086",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53086"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53073",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53073"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53013",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53013"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53063",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53063"
},
{
"published_at": "2026-07-03",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53357",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53357"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53002",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53002"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-52972",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-52972"
},
{
"published_at": "2026-07-03",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-14164",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-14164"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-52958",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-52958"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53082",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53082"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53058",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53058"
},
{
"published_at": "2026-06-29",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-52910",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-52910"
},
{
"published_at": "2026-07-02",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53355",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53355"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53071",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53071"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53022"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-52963",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-52963"
},
{
"published_at": "2026-07-02",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53329",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53329"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53110",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53110"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53111",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53111"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-52933",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-52933"
},
{
"published_at": "2026-06-28",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53314",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53314"
},
{
"published_at": "2026-07-01",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-42055",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42055"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-52968",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-52968"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-52999",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-52999"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53126",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53126"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53088",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53088"
},
{
"published_at": "2026-07-02",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53353",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53353"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53035",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53035"
},
{
"published_at": "2026-07-03",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-12912",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-12912"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-53077",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-53077"
},
{
"published_at": "2026-06-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft Azure Linux CVE-2026-52989",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-52989"
}
]
}
CVE-2026-52970 (GCVE-0-2026-52970)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-06-24 16:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_ct: fix missing expect put in obj eval
nft_ct_expect_obj_eval() allocates an expectation and may call
nf_ct_expect_related(), but never drops its local reference.
Add nf_ct_expect_put(exp) before return to balance allocation.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 857b46027d6f91150797295752581b7155b9d0e1 Version: 857b46027d6f91150797295752581b7155b9d0e1 Version: 857b46027d6f91150797295752581b7155b9d0e1 Version: 857b46027d6f91150797295752581b7155b9d0e1 Version: 857b46027d6f91150797295752581b7155b9d0e1 Version: 857b46027d6f91150797295752581b7155b9d0e1 Version: 857b46027d6f91150797295752581b7155b9d0e1 Version: 857b46027d6f91150797295752581b7155b9d0e1 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nft_ct.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cdb9a25dd3416d427e8b2753210f8baf44207577",
"status": "affected",
"version": "857b46027d6f91150797295752581b7155b9d0e1",
"versionType": "git"
},
{
"lessThan": "26ab32ec73941871c97562ee1f39587950dc3b68",
"status": "affected",
"version": "857b46027d6f91150797295752581b7155b9d0e1",
"versionType": "git"
},
{
"lessThan": "7b96242ceedfe249f158419f3254bcee04173ffe",
"status": "affected",
"version": "857b46027d6f91150797295752581b7155b9d0e1",
"versionType": "git"
},
{
"lessThan": "ecca618e1e339494911090474ed87742c0f73976",
"status": "affected",
"version": "857b46027d6f91150797295752581b7155b9d0e1",
"versionType": "git"
},
{
"lessThan": "2aef1b13d5c0285f340512c6c07eb858fd018fd8",
"status": "affected",
"version": "857b46027d6f91150797295752581b7155b9d0e1",
"versionType": "git"
},
{
"lessThan": "1dced0725e2fae3ac3416274db20a7ff5a46931d",
"status": "affected",
"version": "857b46027d6f91150797295752581b7155b9d0e1",
"versionType": "git"
},
{
"lessThan": "84c422cea5a45fe56be839f25880f21fd33940cd",
"status": "affected",
"version": "857b46027d6f91150797295752581b7155b9d0e1",
"versionType": "git"
},
{
"lessThan": "19f94b6fee75b3ef7fbc06f3745b9a771a8a19a4",
"status": "affected",
"version": "857b46027d6f91150797295752581b7155b9d0e1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nft_ct.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_ct: fix missing expect put in obj eval\n\nnft_ct_expect_obj_eval() allocates an expectation and may call\nnf_ct_expect_related(), but never drops its local reference.\n\nAdd nf_ct_expect_put(exp) before return to balance allocation."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:28:48.882Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cdb9a25dd3416d427e8b2753210f8baf44207577"
},
{
"url": "https://git.kernel.org/stable/c/26ab32ec73941871c97562ee1f39587950dc3b68"
},
{
"url": "https://git.kernel.org/stable/c/7b96242ceedfe249f158419f3254bcee04173ffe"
},
{
"url": "https://git.kernel.org/stable/c/ecca618e1e339494911090474ed87742c0f73976"
},
{
"url": "https://git.kernel.org/stable/c/2aef1b13d5c0285f340512c6c07eb858fd018fd8"
},
{
"url": "https://git.kernel.org/stable/c/1dced0725e2fae3ac3416274db20a7ff5a46931d"
},
{
"url": "https://git.kernel.org/stable/c/84c422cea5a45fe56be839f25880f21fd33940cd"
},
{
"url": "https://git.kernel.org/stable/c/19f94b6fee75b3ef7fbc06f3745b9a771a8a19a4"
}
],
"title": "netfilter: nft_ct: fix missing expect put in obj eval",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52970",
"datePublished": "2026-06-24T16:28:48.882Z",
"dateReserved": "2026-06-09T07:44:35.375Z",
"dateUpdated": "2026-06-24T16:28:48.882Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53110 (GCVE-0-2026-53110)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/bpf: Zero-extend bpf prog return values and kfunc arguments
s390x ABI requires callers to zero-extend unsigned arguments and
sign-extend signed arguments, and callees to zero-extend unsigned
return values and sign-extend signed return values.
s390 BPF JIT currently implements only sign extension. Fix this
omission and implement zero extension too.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/s390/net/bpf_jit_comp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "edc90a12073b9a530064a99945c183dde120cb99",
"status": "affected",
"version": "528eb2cb87bc1353235a6384696b4849bde8b0ba",
"versionType": "git"
},
{
"lessThan": "44c4f999b03f55debb1a0c5ab5c1796895a1adf8",
"status": "affected",
"version": "528eb2cb87bc1353235a6384696b4849bde8b0ba",
"versionType": "git"
},
{
"lessThan": "366b0e05ee24f5ba62bdc7ec1346038258b9a797",
"status": "affected",
"version": "528eb2cb87bc1353235a6384696b4849bde8b0ba",
"versionType": "git"
},
{
"lessThan": "834918a77be51419383bf1dda9f02b81ecf26b34",
"status": "affected",
"version": "528eb2cb87bc1353235a6384696b4849bde8b0ba",
"versionType": "git"
},
{
"lessThan": "202e42e4aa890172366354b233c42c73107a3f59",
"status": "affected",
"version": "528eb2cb87bc1353235a6384696b4849bde8b0ba",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/s390/net/bpf_jit_comp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/bpf: Zero-extend bpf prog return values and kfunc arguments\n\ns390x ABI requires callers to zero-extend unsigned arguments and\nsign-extend signed arguments, and callees to zero-extend unsigned\nreturn values and sign-extend signed return values.\n\ns390 BPF JIT currently implements only sign extension. Fix this\nomission and implement zero extension too."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached by locally loading or attaching BPF programs through the bpf() syscall and then executing the JITed program or generated trampoline. It is not directly reachable from remote network packets without prior local BPF program installation.\nAC:L - An attacker can craft BPF bytecode/attachments that exercise unsigned kfunc arguments or trampoline return values, and there is no race or external timing condition required. The bug is a deterministic ABI/JIT miscompilation on affected s390 systems.\nPR:L - Loading kfunc/tracing BPF normally requires BPF-related capabilities, but BPF token delegation can evaluate these in a non-init user namespace in delegated/containerized deployments. Following the higher-severity rule, this is scored as low privileges rather than requiring real init-namespace root.\nUI:N - No victim action is needed after the attacker can issue the relevant bpf() syscalls. The attacker loads/attaches and triggers the affected BPF program path directly.\nS:U - The vulnerability affects kernel execution in the same security authority as the vulnerable component. It is a local kernel compromise/DoS style issue, not a VM escape or separate security-scope boundary bypass.\nC:H - The missing zero-extension lets attacker-controlled high bits cross the verifier/native ABI boundary for kfunc calls and trampoline returns. This can plausibly turn verifier-assumed bounded values into unsafe kernel values, matching prior BPF JIT verifier-bypass classes with kernel memory disclosure potential.\nI:H - Incorrect unsigned argument or return extension can corrupt kernel control/data flow through kfuncs or BPF modify-return trampolines. Under the required higher-severity assumption, this is treated as exploitable for kernel memory modification or privilege escalation.\nA:H - At minimum, passing ABI-invalid kfunc arguments or malformed trampoline return values can trigger kernel oops/panic paths, as similar BPF JIT argument-extension bugs have done. The attacker can repeatedly load/trigger the crafted BPF program."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:23.053Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/edc90a12073b9a530064a99945c183dde120cb99"
},
{
"url": "https://git.kernel.org/stable/c/44c4f999b03f55debb1a0c5ab5c1796895a1adf8"
},
{
"url": "https://git.kernel.org/stable/c/366b0e05ee24f5ba62bdc7ec1346038258b9a797"
},
{
"url": "https://git.kernel.org/stable/c/834918a77be51419383bf1dda9f02b81ecf26b34"
},
{
"url": "https://git.kernel.org/stable/c/202e42e4aa890172366354b233c42c73107a3f59"
}
],
"title": "s390/bpf: Zero-extend bpf prog return values and kfunc arguments",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53110",
"datePublished": "2026-06-24T16:30:44.036Z",
"dateReserved": "2026-06-09T07:44:35.385Z",
"dateUpdated": "2026-08-05T12:33:23.053Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12912 (GCVE-0-2026-12912)
Vulnerability from cvelistv5
Published
2026-06-29 16:31
Modified
2026-08-24 12:06
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-122 - Heap-based Buffer Overflow
Summary
A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).
References
| URL | Tags | |||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected: 0:4.6.0-8.el10_2.4 < * cpe:/o:redhat:enterprise_linux:10.2 |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12912",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T03:55:36.026Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.6.0-8.el10_2.4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.6.0-6.el10_0.4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.9.4-16.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.0.9-38.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.9.4-13.el8_4.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus_long_life:8.4"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.9.4-13.el8_4.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.9.4-13.el8_6.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.0.9-21.el8_6.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus_long_life:8.6"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.9.4-13.el8_6.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus_long_life:8.6"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.0.9-21.el8_6.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_tus:8.8"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.9.4-13.el8_8.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_tus:8.8"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.0.9-29.el8_8.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.9.4-13.el8_8.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.0.9-29.el8_8.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.4.0-18.el9_8.1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.4.0-8.el9_2.6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.4.0-12.el9_4.6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.4.0-13.el9_6.6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "libtiff-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.7.1-2.4.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unknown",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "mingw-libtiff",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "unaffected",
"packageName": "boost",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
}
],
"datePublic": "2026-04-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS)."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T12:06:55.772Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-12912"
},
{
"name": "RHBZ#2492871",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492871"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12912.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:49671"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41892"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47183"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47184"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54642"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54640"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:58545"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54638"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:58553"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:58554"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:58556"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:50774"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42668"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34890"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:49671: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:41892: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:47183: Red Hat Enterprise Linux AppStream (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:47184: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:54642: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"
},
{
"lang": "en",
"value": "RHSA-2026:54640: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:58545: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:54638: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:58553: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:58554: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:58556: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:50774: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:42668: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:34890: Red Hat Hardened Images"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-25T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-04-16T00:00:00.000Z",
"value": "Made public."
}
],
"title": "libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this issue, applications processing untrusted TIFF images should avoid explicitly configuring `PIXARLOGDATAFMT_8BITABGR` when decoding PixarLog-compressed TIFF images with three samples per pixel. This specific combination of output format and samples per pixel is required to trigger the heap-based buffer overflow."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.6.0-8.el10_2.4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.6.0-6.el10_0.4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.9.4-16.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream",
"cpe:/a:redhat:enterprise_linux:8::crb"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.0.9-38.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.9.4-13.el8_4.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.9.4-13.el8_4.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.9.4-13.el8_6.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.0.9-21.el8_6.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.9.4-13.el8_6.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.0.9-21.el8_6.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream",
"cpe:/a:redhat:rhel_tus:8.8::appstream"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.9.4-13.el8_8.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream",
"cpe:/a:redhat:rhel_tus:8.8::appstream"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.0.9-29.el8_8.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream",
"cpe:/a:redhat:rhel_tus:8.8::appstream"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.9.4-13.el8_8.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream",
"cpe:/a:redhat:rhel_tus:8.8::appstream"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.0.9-29.el8_8.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/a:redhat:enterprise_linux:9::crb"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.4.0-18.el9_8.1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::appstream"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.4.0-8.el9_2.6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4::appstream"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.4.0-12.el9_4.6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6::appstream",
"cpe:/a:redhat:rhel_eus:9.6::crb"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.4.0-13.el9_6.6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "libtiff-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.7.1-2.4.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unknown",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "compat-libtiff3",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "libtiff",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "mingw-libtiff",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "unaffected",
"packageName": "boost",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Ariel Sch\u00f6n for reporting this issue."
}
],
"datePublic": "2026-04-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS)."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T07:58:39.845Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "RHSA-2026:34890",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34890"
},
{
"name": "RHSA-2026:41892",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41892"
},
{
"name": "RHSA-2026:42668",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42668"
},
{
"name": "RHSA-2026:47183",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47183"
},
{
"name": "RHSA-2026:47184",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47184"
},
{
"name": "RHSA-2026:49671",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:49671"
},
{
"name": "RHSA-2026:50774",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:50774"
},
{
"name": "RHSA-2026:54638",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54638"
},
{
"name": "RHSA-2026:54640",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54640"
},
{
"name": "RHSA-2026:54642",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54642"
},
{
"name": "RHSA-2026:58545",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:58545"
},
{
"name": "RHSA-2026:58553",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:58553"
},
{
"name": "RHSA-2026:58554",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:58554"
},
{
"name": "RHSA-2026:58556",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:58556"
},
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-12912"
},
{
"name": "RHBZ#2492871",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492871"
},
{
"url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/873"
},
{
"url": "https://gitlab.com/libtiff/libtiff/-/work_items/824"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-25T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-04-16T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Libtiff: libtiff: heap-based buffer overflow via crafted pixarlog-compressed tiff image",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this issue, applications processing untrusted TIFF images should avoid explicitly configuring `PIXARLOGDATAFMT_8BITABGR` when decoding PixarLog-compressed TIFF images with three samples per pixel. This specific combination of output format and samples per pixel is required to trigger the heap-based buffer overflow."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-122: Heap-based Buffer Overflow"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-12912",
"datePublished": "2026-06-29T16:31:34.581Z",
"dateReserved": "2026-06-22T15:36:26.194Z",
"dateUpdated": "2026-08-24T12:06:55.772Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53096 (GCVE-0-2026-53096)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path
The DEVMAP_HASH branch in dev_map_redirect_multi() uses
hlist_for_each_entry_safe() to iterate hash buckets, but this function
runs under RCU protection (called from xdp_do_generic_redirect_map()
in softirq context). Concurrent writers (__dev_map_hash_update_elem,
dev_map_hash_delete_elem) modify the list using RCU primitives
(hlist_add_head_rcu, hlist_del_rcu).
hlist_for_each_entry_safe() performs plain pointer dereferences without
rcu_dereference(), missing the acquire barrier needed to pair with
writers' rcu_assign_pointer(). On weakly-ordered architectures (ARM64,
POWER), a reader can observe a partially-constructed node. It also
defeats CONFIG_PROVE_RCU lockdep validation and KCSAN data-race
detection.
Replace with hlist_for_each_entry_rcu() using rcu_read_lock_bh_held()
as the lockdep condition, consistent with the rcu_dereference_check()
used in the DEVMAP (non-hash) branch of the same functions. Also fix
the same incorrect lockdep_is_held(&dtab->index_lock) condition in
dev_map_enqueue_multi(), where the lock is not held either.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 Version: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 Version: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 Version: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 Version: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 Version: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 Version: e624d4ed4aa8cc3c69d1359b0aaea539203ed266 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/devmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4a3d0fe30b907ff324b1b49756f7e713d67f3645",
"status": "affected",
"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
"versionType": "git"
},
{
"lessThan": "b089aa6e94d7a08e74d076a0fe274842dc9feccc",
"status": "affected",
"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
"versionType": "git"
},
{
"lessThan": "571a05ea1baaccc0dc1e0d227b2cbc978b96d392",
"status": "affected",
"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
"versionType": "git"
},
{
"lessThan": "cb2c1f3cf65b855548e1b8d55a08bfbaa5a0901a",
"status": "affected",
"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
"versionType": "git"
},
{
"lessThan": "d4c4bd231ebad70e6f30db429e9640bf378b2f52",
"status": "affected",
"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
"versionType": "git"
},
{
"lessThan": "7027e705062482a8cea43a1c13ede3c35653966f",
"status": "affected",
"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
"versionType": "git"
},
{
"lessThan": "8ed82f807bb09d2c8455aaa665f2c6cb17bc6a19",
"status": "affected",
"version": "e624d4ed4aa8cc3c69d1359b0aaea539203ed266",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/devmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path\n\nThe DEVMAP_HASH branch in dev_map_redirect_multi() uses\nhlist_for_each_entry_safe() to iterate hash buckets, but this function\nruns under RCU protection (called from xdp_do_generic_redirect_map()\nin softirq context). Concurrent writers (__dev_map_hash_update_elem,\ndev_map_hash_delete_elem) modify the list using RCU primitives\n(hlist_add_head_rcu, hlist_del_rcu).\n\nhlist_for_each_entry_safe() performs plain pointer dereferences without\nrcu_dereference(), missing the acquire barrier needed to pair with\nwriters\u0027 rcu_assign_pointer(). On weakly-ordered architectures (ARM64,\nPOWER), a reader can observe a partially-constructed node. It also\ndefeats CONFIG_PROVE_RCU lockdep validation and KCSAN data-race\ndetection.\n\nReplace with hlist_for_each_entry_rcu() using rcu_read_lock_bh_held()\nas the lockdep condition, consistent with the rcu_dereference_check()\nused in the DEVMAP (non-hash) branch of the same functions. Also fix\nthe same incorrect lockdep_is_held(\u0026dtab-\u003eindex_lock) condition in\ndev_map_enqueue_multi(), where the lock is not held either."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path requires local BPF/netlink setup of an XDP program using a DEVMAP_HASH broadcast redirect and concurrent map update/delete operations. Network packets can trigger the packet-side reader after setup, but the exploit control path is local.\nAC:L - The attacker can control both sides of the race by driving packets through the attached XDP program while another local thread updates or deletes devmap-hash entries. Weakly ordered architectures such as ARM64/POWER are common reasonable deployments, so this is not a rare external condition.\nPR:L - The path requires BPF/CAP_NET_ADMIN-style privileges to create/update the map and load/attach XDP, but these can be available to a low-privileged local attacker through namespace/delegated BPF-token scenarios. It is not reachable by an unauthenticated remote attacker.\nUI:N - No victim action is needed once the attacker has the local privileges and can run the racing BPF/map operations. Packet delivery and map syscalls are attacker-driven.\nS:U - The impact remains within the kernel and the network namespace/security authority being attacked. This is standard kernel memory-safety exposure, not a VM escape or separate-scope boundary bypass.\nC:H - The unsafe non-RCU traversal can observe partially constructed or inconsistent bpf_dtab_netdev objects and dereference attacker-influenced stale kernel pointers. Given the kernel pointer misuse and heap-shaping potential, high confidentiality impact is defensible.\nI:H - The same stale or partially initialized dev/xdp_prog pointers can be used in redirect and BPF program execution paths, making control-flow or object-confusion style corruption plausible. Under the required overestimate rule, this supports high integrity impact.\nA:H - At minimum, dereferencing inconsistent devmap entries can crash or oops the kernel in the packet redirect path. The race is repeatable by the local attacker, so availability impact is high."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:21.982Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4a3d0fe30b907ff324b1b49756f7e713d67f3645"
},
{
"url": "https://git.kernel.org/stable/c/b089aa6e94d7a08e74d076a0fe274842dc9feccc"
},
{
"url": "https://git.kernel.org/stable/c/571a05ea1baaccc0dc1e0d227b2cbc978b96d392"
},
{
"url": "https://git.kernel.org/stable/c/cb2c1f3cf65b855548e1b8d55a08bfbaa5a0901a"
},
{
"url": "https://git.kernel.org/stable/c/d4c4bd231ebad70e6f30db429e9640bf378b2f52"
},
{
"url": "https://git.kernel.org/stable/c/7027e705062482a8cea43a1c13ede3c35653966f"
},
{
"url": "https://git.kernel.org/stable/c/8ed82f807bb09d2c8455aaa665f2c6cb17bc6a19"
}
],
"title": "bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53096",
"datePublished": "2026-06-24T16:30:34.477Z",
"dateReserved": "2026-06-09T07:44:35.384Z",
"dateUpdated": "2026-08-05T12:33:21.982Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53094 (GCVE-0-2026-53094)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix stale offload->prog pointer after constant blinding
When a dev-bound-only BPF program (BPF_F_XDP_DEV_BOUND_ONLY) undergoes
JIT compilation with constant blinding enabled (bpf_jit_harden >= 2),
bpf_jit_blind_constants() clones the program. The original prog is then
freed in bpf_jit_prog_release_other(), which updates aux->prog to point
to the surviving clone, but fails to update offload->prog.
This leaves offload->prog pointing to the freed original program. When
the network namespace is subsequently destroyed, cleanup_net() triggers
bpf_dev_bound_netdev_unregister(), which iterates ondev->progs and calls
__bpf_prog_offload_destroy(offload->prog). Accessing the freed prog
causes a page fault:
BUG: unable to handle page fault for address: ffffc900085f1038
Workqueue: netns cleanup_net
RIP: 0010:__bpf_prog_offload_destroy+0xc/0x80
Call Trace:
__bpf_offload_dev_netdev_unregister+0x257/0x350
bpf_dev_bound_netdev_unregister+0x4a/0x90
unregister_netdevice_many_notify+0x2a2/0x660
...
cleanup_net+0x21a/0x320
The test sequence that triggers this reliably is:
1. Set net.core.bpf_jit_harden=2 (echo 2 > /proc/sys/net/core/bpf_jit_harden)
2. Run xdp_metadata selftest, which creates a dev-bound-only XDP
program on a veth inside a netns (./test_progs -t xdp_metadata)
3. cleanup_net -> page fault in __bpf_prog_offload_destroy
Dev-bound-only programs are unique in that they have an offload structure
but go through the normal JIT path instead of bpf_prog_offload_compile().
This means they are subject to constant blinding's prog clone-and-replace,
while also having offload->prog that must stay in sync.
Fix this by updating offload->prog in bpf_jit_prog_release_other(),
alongside the existing aux->prog update. Both are back-pointers to
the prog that must be kept in sync when the prog is replaced.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a713b72ff88cdab4d5d692908ab1259ada511f4d",
"status": "affected",
"version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
"versionType": "git"
},
{
"lessThan": "25484c39d1ec82a0368798d956da3de5039b3fe8",
"status": "affected",
"version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
"versionType": "git"
},
{
"lessThan": "059525cf18e69a9313baf947d8898c6ee7ca6b65",
"status": "affected",
"version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
"versionType": "git"
},
{
"lessThan": "c79f8503d83d4665be461fb9e45e215d0380c67b",
"status": "affected",
"version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
"versionType": "git"
},
{
"lessThan": "a1aa9ef47c299c5bbc30594d3c2f0589edf908e6",
"status": "affected",
"version": "2b3486bc2d237ec345b3942b7be5deabf8c8fed1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix stale offload-\u003eprog pointer after constant blinding\n\nWhen a dev-bound-only BPF program (BPF_F_XDP_DEV_BOUND_ONLY) undergoes\nJIT compilation with constant blinding enabled (bpf_jit_harden \u003e= 2),\nbpf_jit_blind_constants() clones the program. The original prog is then\nfreed in bpf_jit_prog_release_other(), which updates aux-\u003eprog to point\nto the surviving clone, but fails to update offload-\u003eprog.\n\nThis leaves offload-\u003eprog pointing to the freed original program. When\nthe network namespace is subsequently destroyed, cleanup_net() triggers\nbpf_dev_bound_netdev_unregister(), which iterates ondev-\u003eprogs and calls\n__bpf_prog_offload_destroy(offload-\u003eprog). Accessing the freed prog\ncauses a page fault:\n\nBUG: unable to handle page fault for address: ffffc900085f1038\nWorkqueue: netns cleanup_net\nRIP: 0010:__bpf_prog_offload_destroy+0xc/0x80\nCall Trace:\n__bpf_offload_dev_netdev_unregister+0x257/0x350\nbpf_dev_bound_netdev_unregister+0x4a/0x90\nunregister_netdevice_many_notify+0x2a2/0x660\n...\ncleanup_net+0x21a/0x320\n\nThe test sequence that triggers this reliably is:\n\n1. Set net.core.bpf_jit_harden=2 (echo 2 \u003e /proc/sys/net/core/bpf_jit_harden)\n2. Run xdp_metadata selftest, which creates a dev-bound-only XDP\n program on a veth inside a netns (./test_progs -t xdp_metadata)\n3. cleanup_net -\u003e page fault in __bpf_prog_offload_destroy\n\nDev-bound-only programs are unique in that they have an offload structure\nbut go through the normal JIT path instead of bpf_prog_offload_compile().\nThis means they are subject to constant blinding\u0027s prog clone-and-replace,\nwhile also having offload-\u003eprog that must stay in sync.\n\nFix this by updating offload-\u003eprog in bpf_jit_prog_release_other(),\nalongside the existing aux-\u003eprog update. Both are back-pointers to\nthe prog that must be kept in sync when the prog is replaced."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local `bpf(BPF_PROG_LOAD)` and netlink/netns operations used to create and tear down a device-bound XDP program, not by remote packets.\nAC:L - Once the target has BPF JIT hardening set to blind constants for all users, the trigger is deterministic: load a dev-bound-only XDP program with constants, then unregister the device or destroy the netns. There is no attacker-uncontrolled race to win.\nPR:L - XDP program loading requires BPF and NET_ADMIN privileges, but these can be available in user-namespace/container deployments through BPF token delegation and namespaced capabilities. Under the required rule, this is scored as Low rather than High.\nUI:N - No victim action is required after the attacker has local execution; the attacker can perform the BPF load and netdevice/netns teardown directly.\nS:U - The bug corrupts/dereferences kernel memory within the same kernel security authority. This is standard local kernel compromise/DoS rather than a VM or hardware isolation boundary escape.\nC:H - The stale `offload-\u003eprog` is a use-after-free of a `struct bpf_prog`; if reclaimed, the cleanup path trusts attacker-shaped pointers and can be developed into kernel memory disclosure primitives. Kernel UAFs are scored High for confidentiality.\nI:H - The same UAF can drive trusted list/free/write operations through forged `prog-\u003eaux` and `offload` pointers, making arbitrary kernel memory corruption or code execution plausible. Kernel UAFs are scored High for integrity.\nA:H - The upstream report shows a reliable kernel page fault during `cleanup_net()`/netdevice unregister when the stale pointer is dereferenced. This is a kernel crash availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:20.910Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a713b72ff88cdab4d5d692908ab1259ada511f4d"
},
{
"url": "https://git.kernel.org/stable/c/25484c39d1ec82a0368798d956da3de5039b3fe8"
},
{
"url": "https://git.kernel.org/stable/c/059525cf18e69a9313baf947d8898c6ee7ca6b65"
},
{
"url": "https://git.kernel.org/stable/c/c79f8503d83d4665be461fb9e45e215d0380c67b"
},
{
"url": "https://git.kernel.org/stable/c/a1aa9ef47c299c5bbc30594d3c2f0589edf908e6"
}
],
"title": "bpf: Fix stale offload-\u003eprog pointer after constant blinding",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53094",
"datePublished": "2026-06-24T16:30:32.815Z",
"dateReserved": "2026-06-09T07:44:35.384Z",
"dateUpdated": "2026-08-05T12:33:20.910Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52963 (GCVE-0-2026-52963)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-06-24 16:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Bound MIDI endpoint descriptor scans
snd_usbmidi_get_ms_info() validates the internal MIDIStreaming endpoint
descriptor size before using baAssocJackID[], but the descriptor walker can
still return a class-specific endpoint descriptor whose bLength exceeds the
remaining bytes in the endpoint-extra scan.
That leaves later flexible-array reads bounded by bLength, but not by the
remaining bytes in the endpoint-extra scan.
Stop walking when bLength is zero or
extends past the remaining endpoint-extra scan.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5c6cd7021a05a02fcf37f360592d7c18d4d807fb Version: 5c6cd7021a05a02fcf37f360592d7c18d4d807fb Version: 5c6cd7021a05a02fcf37f360592d7c18d4d807fb Version: 5c6cd7021a05a02fcf37f360592d7c18d4d807fb Version: 5c6cd7021a05a02fcf37f360592d7c18d4d807fb Version: 5c6cd7021a05a02fcf37f360592d7c18d4d807fb Version: 5c6cd7021a05a02fcf37f360592d7c18d4d807fb Version: 5c6cd7021a05a02fcf37f360592d7c18d4d807fb Version: 9e0c71f2f633b0442661966228827d1a33df485f Version: 0868bc5654c07628c421547f0821650a8c2cb8f3 Version: 78483c1c7741ffa72991d93d19a75bfdcc2cbf57 Version: 65d95462001c6ccd9bc9499c1fc9a90eca9de496 Version: ca767cf0152d18fc299cde85b18d1f46ac21e1ba Version: 4.4.238 ≤ Version: 4.9.238 ≤ Version: 4.14.200 ≤ Version: 4.19.149 ≤ Version: 5.4.69 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/midi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e2f1260a056eb3215c13c48c5378f3e4112dc3af",
"status": "affected",
"version": "5c6cd7021a05a02fcf37f360592d7c18d4d807fb",
"versionType": "git"
},
{
"lessThan": "c65b137d351e21cbc5630e73ef0eb1e1d75f5b20",
"status": "affected",
"version": "5c6cd7021a05a02fcf37f360592d7c18d4d807fb",
"versionType": "git"
},
{
"lessThan": "728ab0c72e49ca27185067984cd565425eb69b2e",
"status": "affected",
"version": "5c6cd7021a05a02fcf37f360592d7c18d4d807fb",
"versionType": "git"
},
{
"lessThan": "3d3b2b01a3e73828e201ece96f863e7a3e0cdc6e",
"status": "affected",
"version": "5c6cd7021a05a02fcf37f360592d7c18d4d807fb",
"versionType": "git"
},
{
"lessThan": "a0226560540c16717efcceaf15c862cf115b01d3",
"status": "affected",
"version": "5c6cd7021a05a02fcf37f360592d7c18d4d807fb",
"versionType": "git"
},
{
"lessThan": "09141583bd97f4bbd7358e29fd138fe798467cdb",
"status": "affected",
"version": "5c6cd7021a05a02fcf37f360592d7c18d4d807fb",
"versionType": "git"
},
{
"lessThan": "c59159ce10e75b568cd0d4b29efcb0fb0ddecc94",
"status": "affected",
"version": "5c6cd7021a05a02fcf37f360592d7c18d4d807fb",
"versionType": "git"
},
{
"lessThan": "d6854daa67be623860f4e1873fd3d3c275aba4ed",
"status": "affected",
"version": "5c6cd7021a05a02fcf37f360592d7c18d4d807fb",
"versionType": "git"
},
{
"status": "affected",
"version": "9e0c71f2f633b0442661966228827d1a33df485f",
"versionType": "git"
},
{
"status": "affected",
"version": "0868bc5654c07628c421547f0821650a8c2cb8f3",
"versionType": "git"
},
{
"status": "affected",
"version": "78483c1c7741ffa72991d93d19a75bfdcc2cbf57",
"versionType": "git"
},
{
"status": "affected",
"version": "65d95462001c6ccd9bc9499c1fc9a90eca9de496",
"versionType": "git"
},
{
"status": "affected",
"version": "ca767cf0152d18fc299cde85b18d1f46ac21e1ba",
"versionType": "git"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.238",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.238",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.200",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.149",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.69",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/usb/midi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.238",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.238",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.200",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.149",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.69",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Bound MIDI endpoint descriptor scans\n\nsnd_usbmidi_get_ms_info() validates the internal MIDIStreaming endpoint\ndescriptor size before using baAssocJackID[], but the descriptor walker can\nstill return a class-specific endpoint descriptor whose bLength exceeds the\nremaining bytes in the endpoint-extra scan.\n\nThat leaves later flexible-array reads bounded by bLength, but not by the\nremaining bytes in the endpoint-extra scan.\n\nStop walking when bLength is zero or\nextends past the remaining endpoint-extra scan."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:28:43.593Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e2f1260a056eb3215c13c48c5378f3e4112dc3af"
},
{
"url": "https://git.kernel.org/stable/c/c65b137d351e21cbc5630e73ef0eb1e1d75f5b20"
},
{
"url": "https://git.kernel.org/stable/c/728ab0c72e49ca27185067984cd565425eb69b2e"
},
{
"url": "https://git.kernel.org/stable/c/3d3b2b01a3e73828e201ece96f863e7a3e0cdc6e"
},
{
"url": "https://git.kernel.org/stable/c/a0226560540c16717efcceaf15c862cf115b01d3"
},
{
"url": "https://git.kernel.org/stable/c/09141583bd97f4bbd7358e29fd138fe798467cdb"
},
{
"url": "https://git.kernel.org/stable/c/c59159ce10e75b568cd0d4b29efcb0fb0ddecc94"
},
{
"url": "https://git.kernel.org/stable/c/d6854daa67be623860f4e1873fd3d3c275aba4ed"
}
],
"title": "ALSA: usb-audio: Bound MIDI endpoint descriptor scans",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52963",
"datePublished": "2026-06-24T16:28:43.593Z",
"dateReserved": "2026-06-09T07:44:35.374Z",
"dateUpdated": "2026-06-24T16:28:43.593Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53126 (GCVE-0-2026-53126)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-06-24 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()
Add the missing put_disk() on the error path in
blkcg_maybe_throttle_current(). When blkcg lookup, blkg lookup, or
blkg_tryget() fails, the function jumps to the out label which only
calls rcu_read_unlock() but does not release the disk reference acquired
by blkcg_schedule_throttle() via get_device(). Since current->throttle_disk
is already set to NULL before the lookup, blkcg_exit() cannot release
this reference either, causing the disk to never be freed.
Restore the reference release that was present as blk_put_queue() in the
original code but was inadvertently dropped during the conversion from
request_queue to gendisk.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"block/blk-cgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4048ed98860d3785645ebbd34f69566a6c7320c3",
"status": "affected",
"version": "f05837ed73d0c73e950b2d9f2612febb0d3d451e",
"versionType": "git"
},
{
"lessThan": "73a5af059905d171b398c8b2381632ee499948b5",
"status": "affected",
"version": "f05837ed73d0c73e950b2d9f2612febb0d3d451e",
"versionType": "git"
},
{
"lessThan": "b3e005f16cd98f815429a87aef4c61e9c140779f",
"status": "affected",
"version": "f05837ed73d0c73e950b2d9f2612febb0d3d451e",
"versionType": "git"
},
{
"lessThan": "000e8454692cab9d1f1b80130e2870e355301d06",
"status": "affected",
"version": "f05837ed73d0c73e950b2d9f2612febb0d3d451e",
"versionType": "git"
},
{
"lessThan": "23308af722fefed00af5f238024c11710938fba3",
"status": "affected",
"version": "f05837ed73d0c73e950b2d9f2612febb0d3d451e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"block/blk-cgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()\n\nAdd the missing put_disk() on the error path in\nblkcg_maybe_throttle_current(). When blkcg lookup, blkg lookup, or\nblkg_tryget() fails, the function jumps to the out label which only\ncalls rcu_read_unlock() but does not release the disk reference acquired\nby blkcg_schedule_throttle() via get_device(). Since current-\u003ethrottle_disk\nis already set to NULL before the lookup, blkcg_exit() cannot release\nthis reference either, causing the disk to never be freed.\n\nRestore the reference release that was present as blk_put_queue() in the\noriginal code but was inadvertently dropped during the conversion from\nrequest_queue to gendisk."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:54.594Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4048ed98860d3785645ebbd34f69566a6c7320c3"
},
{
"url": "https://git.kernel.org/stable/c/73a5af059905d171b398c8b2381632ee499948b5"
},
{
"url": "https://git.kernel.org/stable/c/b3e005f16cd98f815429a87aef4c61e9c140779f"
},
{
"url": "https://git.kernel.org/stable/c/000e8454692cab9d1f1b80130e2870e355301d06"
},
{
"url": "https://git.kernel.org/stable/c/23308af722fefed00af5f238024c11710938fba3"
}
],
"title": "blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53126",
"datePublished": "2026-06-24T16:30:54.594Z",
"dateReserved": "2026-06-09T07:44:35.386Z",
"dateUpdated": "2026-06-24T16:30:54.594Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53011 (GCVE-0-2026-53011)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: taprio: fix use-after-free in advance_sched() on schedule switch
In advance_sched(), when should_change_schedules() returns true,
switch_schedules() is called to promote the admin schedule to oper.
switch_schedules() queues the old oper schedule for RCU freeing via
call_rcu(), but 'next' still points into an entry of the old oper
schedule. The subsequent 'next->end_time = end_time' and
rcu_assign_pointer(q->current_entry, next) are use-after-free.
Fix this by selecting 'next' from the new oper schedule immediately
after switch_schedules(), and using its pre-calculated end_time.
setup_first_end_time() sets the first entry's end_time to
base_time + interval when the schedule is installed, so the value
is already correct.
The deleted 'end_time = sched_base_time(admin)' assignment was also
harmful independently: it would overwrite the new first entry's
pre-calculated end_time with just base_time.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a3d43c0d56f1b94e74963a2fbadfb70126d92213 Version: a3d43c0d56f1b94e74963a2fbadfb70126d92213 Version: a3d43c0d56f1b94e74963a2fbadfb70126d92213 Version: a3d43c0d56f1b94e74963a2fbadfb70126d92213 Version: a3d43c0d56f1b94e74963a2fbadfb70126d92213 Version: a3d43c0d56f1b94e74963a2fbadfb70126d92213 Version: a3d43c0d56f1b94e74963a2fbadfb70126d92213 Version: a3d43c0d56f1b94e74963a2fbadfb70126d92213 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/sch_taprio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a8fc396519ef4f081bc545e88f61241728bb78d7",
"status": "affected",
"version": "a3d43c0d56f1b94e74963a2fbadfb70126d92213",
"versionType": "git"
},
{
"lessThan": "3471874578160a28c171a607fa069f24062634b8",
"status": "affected",
"version": "a3d43c0d56f1b94e74963a2fbadfb70126d92213",
"versionType": "git"
},
{
"lessThan": "7256996e1ef553716817f3bfd077c2f3b48b582f",
"status": "affected",
"version": "a3d43c0d56f1b94e74963a2fbadfb70126d92213",
"versionType": "git"
},
{
"lessThan": "eee072fe16c646190d33ae69c9983d8de1562bf8",
"status": "affected",
"version": "a3d43c0d56f1b94e74963a2fbadfb70126d92213",
"versionType": "git"
},
{
"lessThan": "1bd286fa3e21200133478ed523cc6a2788baf38a",
"status": "affected",
"version": "a3d43c0d56f1b94e74963a2fbadfb70126d92213",
"versionType": "git"
},
{
"lessThan": "b73235da5dde77ed1264f9767b62c28c9d71fd78",
"status": "affected",
"version": "a3d43c0d56f1b94e74963a2fbadfb70126d92213",
"versionType": "git"
},
{
"lessThan": "0e62171df8ed4804d00db088f17eed06468233fa",
"status": "affected",
"version": "a3d43c0d56f1b94e74963a2fbadfb70126d92213",
"versionType": "git"
},
{
"lessThan": "105425b1969c5affe532713cfac1c0b320d7ac2b",
"status": "affected",
"version": "a3d43c0d56f1b94e74963a2fbadfb70126d92213",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/sch_taprio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: taprio: fix use-after-free in advance_sched() on schedule switch\n\nIn advance_sched(), when should_change_schedules() returns true,\nswitch_schedules() is called to promote the admin schedule to oper.\nswitch_schedules() queues the old oper schedule for RCU freeing via\ncall_rcu(), but \u0027next\u0027 still points into an entry of the old oper\nschedule. The subsequent \u0027next-\u003eend_time = end_time\u0027 and\nrcu_assign_pointer(q-\u003ecurrent_entry, next) are use-after-free.\n\nFix this by selecting \u0027next\u0027 from the new oper schedule immediately\nafter switch_schedules(), and using its pre-calculated end_time.\nsetup_first_end_time() sets the first entry\u0027s end_time to\nbase_time + interval when the schedule is installed, so the value\nis already correct.\n\nThe deleted \u0027end_time = sched_base_time(admin)\u0027 assignment was also\nharmful independently: it would overwrite the new first entry\u0027s\npre-calculated end_time with just base_time."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable taprio schedule switch is reached through local `NETLINK_ROUTE`/tc qdisc configuration, not by unauthenticated network packets. An attacker sends `RTM_NEWQDISC` messages to install and later switch taprio schedules.\nAC:L - The trigger is deterministic once the attacker installs an oper schedule and a later admin schedule with chosen base times/intervals. The attacker controls the schedule timing, so no condition beyond attacker control is required.\nPR:L - The rtnetlink qdisc path requires `CAP_NET_ADMIN` in the target network namespace. Because tc/qdisc configuration is reachable with namespaced `CAP_NET_ADMIN` via user namespaces in reasonable deployments, this is low privilege rather than high privilege.\nUI:N - No victim action is required after the attacker can issue the local netlink configuration. The hrtimer-driven schedule transition occurs automatically.\nS:U - The vulnerability corrupts kernel memory within the same kernel security authority. It is a standard local kernel privilege-escalation/DoS class issue, not a VM or hardware boundary escape.\nC:H - This is a use-after-free of taprio schedule entry memory that leaves `current_entry` pointing into freed objects. As a kernel UAF, it can plausibly be shaped into memory disclosure primitives.\nI:H - The stale schedule entry is later written and used by scheduler/dequeue paths, giving attacker-influenced heap corruption potential. Under the required kernel guidance, a UAF is high integrity impact because it can be leveraged for arbitrary write or control-flow compromise.\nA:H - The dangling schedule entry can be dereferenced after RCU freeing by the timer or dequeue path. Even without full exploitation, this can cause kernel oops, panic, or repeated crashes."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:38.643Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a8fc396519ef4f081bc545e88f61241728bb78d7"
},
{
"url": "https://git.kernel.org/stable/c/3471874578160a28c171a607fa069f24062634b8"
},
{
"url": "https://git.kernel.org/stable/c/7256996e1ef553716817f3bfd077c2f3b48b582f"
},
{
"url": "https://git.kernel.org/stable/c/eee072fe16c646190d33ae69c9983d8de1562bf8"
},
{
"url": "https://git.kernel.org/stable/c/1bd286fa3e21200133478ed523cc6a2788baf38a"
},
{
"url": "https://git.kernel.org/stable/c/b73235da5dde77ed1264f9767b62c28c9d71fd78"
},
{
"url": "https://git.kernel.org/stable/c/0e62171df8ed4804d00db088f17eed06468233fa"
},
{
"url": "https://git.kernel.org/stable/c/105425b1969c5affe532713cfac1c0b320d7ac2b"
}
],
"title": "net/sched: taprio: fix use-after-free in advance_sched() on schedule switch",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53011",
"datePublished": "2026-06-24T16:29:22.082Z",
"dateReserved": "2026-06-09T07:44:35.378Z",
"dateUpdated": "2026-08-05T12:32:38.643Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53068 (GCVE-0-2026-53068)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/komeda: fix integer overflow in AFBC framebuffer size check
The AFBC framebuffer size validation calculates the minimum required
buffer size by adding the AFBC payload size to the framebuffer offset.
This addition is performed without checking for integer overflow.
If the addition oveflows, the size check may incorrectly succed and
allow userspace to provide an undersized drm_gem_object, potentially
leading to out-of-bounds memory access.
Add usage of check_add_overflow() to safely compute the minimum
required size and reject the framebuffer if an overflow is detected.
This makes the AFBC size validation more robust against malformed.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 65ad2392dd6d1691db93e82b08d3311298b9d64a Version: 65ad2392dd6d1691db93e82b08d3311298b9d64a Version: 65ad2392dd6d1691db93e82b08d3311298b9d64a Version: 65ad2392dd6d1691db93e82b08d3311298b9d64a Version: 65ad2392dd6d1691db93e82b08d3311298b9d64a Version: 65ad2392dd6d1691db93e82b08d3311298b9d64a Version: 65ad2392dd6d1691db93e82b08d3311298b9d64a Version: 65ad2392dd6d1691db93e82b08d3311298b9d64a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a3a2a9bdc0f9c2d863a5a290cb2d4a565f7268e7",
"status": "affected",
"version": "65ad2392dd6d1691db93e82b08d3311298b9d64a",
"versionType": "git"
},
{
"lessThan": "e27b58095d7d3ac72f230e318838dee956258460",
"status": "affected",
"version": "65ad2392dd6d1691db93e82b08d3311298b9d64a",
"versionType": "git"
},
{
"lessThan": "02ff8a7d3d0eecc546b9ab4c07b3d7c65d485583",
"status": "affected",
"version": "65ad2392dd6d1691db93e82b08d3311298b9d64a",
"versionType": "git"
},
{
"lessThan": "d8a541906860aa3519b1874780d933c766918a7c",
"status": "affected",
"version": "65ad2392dd6d1691db93e82b08d3311298b9d64a",
"versionType": "git"
},
{
"lessThan": "8165e8b28fdf392c2c7412518d602b4f193812a8",
"status": "affected",
"version": "65ad2392dd6d1691db93e82b08d3311298b9d64a",
"versionType": "git"
},
{
"lessThan": "fe1f80f8f6e8611ac6349b9d464e8750443390cf",
"status": "affected",
"version": "65ad2392dd6d1691db93e82b08d3311298b9d64a",
"versionType": "git"
},
{
"lessThan": "872d923b852705054bc099af663da862fdc1097d",
"status": "affected",
"version": "65ad2392dd6d1691db93e82b08d3311298b9d64a",
"versionType": "git"
},
{
"lessThan": "779ec12c85c9e4547519e3903a371a3b26a289de",
"status": "affected",
"version": "65ad2392dd6d1691db93e82b08d3311298b9d64a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/komeda: fix integer overflow in AFBC framebuffer size check\n\nThe AFBC framebuffer size validation calculates the minimum required\nbuffer size by adding the AFBC payload size to the framebuffer offset.\nThis addition is performed without checking for integer overflow.\n\nIf the addition oveflows, the size check may incorrectly succed and\nallow userspace to provide an undersized drm_gem_object, potentially\nleading to out-of-bounds memory access.\n\nAdd usage of check_add_overflow() to safely compute the minimum\nrequired size and reject the framebuffer if an overflow is detected.\nThis makes the AFBC size validation more robust against malformed.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached from local userspace through DRM ioctls, specifically framebuffer creation with `DRM_IOCTL_MODE_ADDFB2` on a Komeda DRM device. It is not reachable by network or adjacent-only input.\nAC:L - The attacker controls the framebuffer dimensions, modifier, offset, and GEM handle inputs needed to trigger the integer overflow. No race or external timing condition is required.\nPR:L - The vulnerable `ADDFB2` path has no root, auth, or master ioctl flag, but it requires local access to the DRM device node and a valid GEM handle. Triggering hardware consumption of the framebuffer uses normal local DRM modeset privileges rather than init-namespace root.\nUI:N - An attacker with local DRM device access can issue the required ioctls directly. No separate victim action is required.\nS:U - The impact remains within the local kernel/device security authority. This is not a VM escape, guest-to-host boundary crossing, or demonstrated IOMMU isolation bypass.\nC:H - The overflow can allow an undersized GEM object to pass validation and cause the display engine to DMA-read outside the framebuffer allocation. Because this is an out-of-bounds read from system memory and is not tightly bounded, confidentiality is high.\nI:N - The reachable AFBC framebuffer use is a display source path, so the hardware consumes memory rather than writing to it. The writeback path rejects AFBC framebuffers through layer capability checks, so a direct out-of-bounds write was not established.\nA:H - Out-of-bounds DMA reads can trigger AXI/TBU/IOMMU faults or wedge the display pipeline, and on some deployments may escalate to a kernel-visible hardware fault. The issue can be triggered repeatedly from local userspace once the device is accessible."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:02.612Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a3a2a9bdc0f9c2d863a5a290cb2d4a565f7268e7"
},
{
"url": "https://git.kernel.org/stable/c/e27b58095d7d3ac72f230e318838dee956258460"
},
{
"url": "https://git.kernel.org/stable/c/02ff8a7d3d0eecc546b9ab4c07b3d7c65d485583"
},
{
"url": "https://git.kernel.org/stable/c/d8a541906860aa3519b1874780d933c766918a7c"
},
{
"url": "https://git.kernel.org/stable/c/8165e8b28fdf392c2c7412518d602b4f193812a8"
},
{
"url": "https://git.kernel.org/stable/c/fe1f80f8f6e8611ac6349b9d464e8750443390cf"
},
{
"url": "https://git.kernel.org/stable/c/872d923b852705054bc099af663da862fdc1097d"
},
{
"url": "https://git.kernel.org/stable/c/779ec12c85c9e4547519e3903a371a3b26a289de"
}
],
"title": "drm/komeda: fix integer overflow in AFBC framebuffer size check",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53068",
"datePublished": "2026-06-24T16:30:10.140Z",
"dateReserved": "2026-06-09T07:44:35.382Z",
"dateUpdated": "2026-08-05T12:33:02.612Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53063 (GCVE-0-2026-53063)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-06-24 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm cache: fix write hang in passthrough mode
The invalidate_remove() function has incomplete logic for handling write
hit bios after cache invalidation. It sets up the remapping for the
overwrite_bio but then drops it immediately without submission, causing
write operations to hang.
Fix by adding a new invalidate_committed() continuation that submits
the remapped writes to the cache origin after metadata commit completes,
while using the overwrite_endio hook to ensure proper completion
sequencing. This maintains existing coherency. Also improve error
handling in invalidate_complete() to preserve the original error status
instead of using bio_io_error() unconditionally.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b29d4986d0da1a27cd35917cdb433672f5c95d7f Version: b29d4986d0da1a27cd35917cdb433672f5c95d7f Version: b29d4986d0da1a27cd35917cdb433672f5c95d7f Version: b29d4986d0da1a27cd35917cdb433672f5c95d7f Version: b29d4986d0da1a27cd35917cdb433672f5c95d7f Version: b29d4986d0da1a27cd35917cdb433672f5c95d7f |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-cache-target.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9fa18d0b981776b190ca4632942a7c2174052b78",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "ecb10c193cbebf5e6984246a9b4ff1f95d45ed87",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "64d6519b00be4116d365bd31f33a5e5ce2944c1a",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "b8ace9e96983abb20ccf39edce8a60f1bb0b83d8",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "05798d091ebcfb6d68228890e593f209e8ac940d",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "4ca8b8bd952df7c3ccdc68af9bd3419d0839a04b",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-cache-target.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm cache: fix write hang in passthrough mode\n\nThe invalidate_remove() function has incomplete logic for handling write\nhit bios after cache invalidation. It sets up the remapping for the\noverwrite_bio but then drops it immediately without submission, causing\nwrite operations to hang.\n\nFix by adding a new invalidate_committed() continuation that submits\nthe remapped writes to the cache origin after metadata commit completes,\nwhile using the overwrite_endio hook to ensure proper completion\nsequencing. This maintains existing coherency. Also improve error\nhandling in invalidate_complete() to preserve the original error status\ninstead of using bio_io_error() unconditionally."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:06.857Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9fa18d0b981776b190ca4632942a7c2174052b78"
},
{
"url": "https://git.kernel.org/stable/c/ecb10c193cbebf5e6984246a9b4ff1f95d45ed87"
},
{
"url": "https://git.kernel.org/stable/c/64d6519b00be4116d365bd31f33a5e5ce2944c1a"
},
{
"url": "https://git.kernel.org/stable/c/b8ace9e96983abb20ccf39edce8a60f1bb0b83d8"
},
{
"url": "https://git.kernel.org/stable/c/05798d091ebcfb6d68228890e593f209e8ac940d"
},
{
"url": "https://git.kernel.org/stable/c/4ca8b8bd952df7c3ccdc68af9bd3419d0839a04b"
}
],
"title": "dm cache: fix write hang in passthrough mode",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53063",
"datePublished": "2026-06-24T16:30:06.857Z",
"dateReserved": "2026-06-09T07:44:35.382Z",
"dateUpdated": "2026-06-24T16:30:06.857Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53347 (GCVE-0-2026-53347)
Vulnerability from cvelistv5
Published
2026-07-01 13:32
Modified
2026-07-01 13:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: Fix driver removal with disabled KMS
DRM atomic and modesetting aren't initialized if virtio-gpu driver built
with disabled KMS, leading to access of uninitialized data on driver
removal/unbinding and crashing kernel. Fix it by skipping shutting down
atomic core with unavailable KMS.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/virtio/virtgpu_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ed3e134700a2e07caa99b9bc0683ebbe0327c562",
"status": "affected",
"version": "72122c69d71784e390527819754ea456421c4501",
"versionType": "git"
},
{
"lessThan": "38a5f891cda6d121c149c94cda89c31ec7024ee3",
"status": "affected",
"version": "72122c69d71784e390527819754ea456421c4501",
"versionType": "git"
},
{
"lessThan": "19a6a00ff50c284f3a9818882ad2be58b33b790a",
"status": "affected",
"version": "72122c69d71784e390527819754ea456421c4501",
"versionType": "git"
},
{
"lessThan": "15e561869a8b4e4db69733be1d6f33770664f989",
"status": "affected",
"version": "72122c69d71784e390527819754ea456421c4501",
"versionType": "git"
},
{
"lessThan": "f329e8325e054bd6d84d10904f8dd51137281b92",
"status": "affected",
"version": "72122c69d71784e390527819754ea456421c4501",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/virtio/virtgpu_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: Fix driver removal with disabled KMS\n\nDRM atomic and modesetting aren\u0027t initialized if virtio-gpu driver built\nwith disabled KMS, leading to access of uninitialized data on driver\nremoval/unbinding and crashing kernel. Fix it by skipping shutting down\natomic core with unavailable KMS."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T13:32:26.262Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ed3e134700a2e07caa99b9bc0683ebbe0327c562"
},
{
"url": "https://git.kernel.org/stable/c/38a5f891cda6d121c149c94cda89c31ec7024ee3"
},
{
"url": "https://git.kernel.org/stable/c/19a6a00ff50c284f3a9818882ad2be58b33b790a"
},
{
"url": "https://git.kernel.org/stable/c/15e561869a8b4e4db69733be1d6f33770664f989"
},
{
"url": "https://git.kernel.org/stable/c/f329e8325e054bd6d84d10904f8dd51137281b92"
}
],
"title": "drm/virtio: Fix driver removal with disabled KMS",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53347",
"datePublished": "2026-07-01T13:32:26.262Z",
"dateReserved": "2026-06-09T07:44:35.399Z",
"dateUpdated": "2026-07-01T13:32:26.262Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52925 (GCVE-0-2026-52925)
Vulnerability from cvelistv5
Published
2026-06-24 07:14
Modified
2026-06-24 07:14
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
vrf: Fix a potential NPD when removing a port from a VRF
RCU readers that identified a net device as a VRF port using
netif_is_l3_slave() assume that a subsequent call to
netdev_master_upper_dev_get_rcu() will return a VRF device. They then
continue to dereference its l3mdev operations.
This assumption is not always correct and can result in a NPD [1]. There
is no RCU synchronization when removing a port from a VRF, so it is
possible for an RCU reader to see a new master device (e.g., a bridge)
that does not have l3mdev operations.
Fix by adding RCU synchronization after clearing the IFF_L3MDEV_SLAVE
flag. Skip this synchronization when a net device is removed from a VRF
as part of its deletion and when the VRF device itself is deleted. In
the latter case an RCU grace period will pass by the time RTNL is
released.
[1]
BUG: kernel NULL pointer dereference, address: 0000000000000000
[...]
RIP: 0010:l3mdev_fib_table_rcu (net/l3mdev/l3mdev.c:181)
[...]
Call Trace:
<TASK>
l3mdev_fib_table_by_index (net/l3mdev/l3mdev.c:201 net/l3mdev/l3mdev.c:189)
__inet_bind (net/ipv4/af_inet.c:499 (discriminator 3))
inet_bind_sk (net/ipv4/af_inet.c:469)
__sys_bind (./include/linux/file.h:62 (discriminator 1) ./include/linux/file.h:83 (discriminator 1) net/socket.c:1951 (discriminator 1))
__x64_sys_bind (net/socket.c:1969 (discriminator 1) net/socket.c:1967 (discriminator 1) net/socket.c:1967 (discriminator 1))
do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: fdeea7be88b12742bfd50d9e19a06c0d2e702400 Version: fdeea7be88b12742bfd50d9e19a06c0d2e702400 Version: fdeea7be88b12742bfd50d9e19a06c0d2e702400 Version: fdeea7be88b12742bfd50d9e19a06c0d2e702400 Version: fdeea7be88b12742bfd50d9e19a06c0d2e702400 Version: fdeea7be88b12742bfd50d9e19a06c0d2e702400 Version: fdeea7be88b12742bfd50d9e19a06c0d2e702400 Version: fdeea7be88b12742bfd50d9e19a06c0d2e702400 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/vrf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2c022f582fd16a470df6ed9e7fb7e9fc48946d49",
"status": "affected",
"version": "fdeea7be88b12742bfd50d9e19a06c0d2e702400",
"versionType": "git"
},
{
"lessThan": "4ab6fc60ed5a0344b60711b09bff1dc238d8d6a4",
"status": "affected",
"version": "fdeea7be88b12742bfd50d9e19a06c0d2e702400",
"versionType": "git"
},
{
"lessThan": "468defa0b70902a22f4478c1207624bc1b31c124",
"status": "affected",
"version": "fdeea7be88b12742bfd50d9e19a06c0d2e702400",
"versionType": "git"
},
{
"lessThan": "3db8d078f7f652379ee394132b169d304f6eb4c1",
"status": "affected",
"version": "fdeea7be88b12742bfd50d9e19a06c0d2e702400",
"versionType": "git"
},
{
"lessThan": "8c2b792f04a3db97c9d8d2a45817e93f8884baf5",
"status": "affected",
"version": "fdeea7be88b12742bfd50d9e19a06c0d2e702400",
"versionType": "git"
},
{
"lessThan": "a7a97f2303e63ede105c1d55ef53dc497364e11d",
"status": "affected",
"version": "fdeea7be88b12742bfd50d9e19a06c0d2e702400",
"versionType": "git"
},
{
"lessThan": "d47204c127992da0c976ac9747070a575912e0fe",
"status": "affected",
"version": "fdeea7be88b12742bfd50d9e19a06c0d2e702400",
"versionType": "git"
},
{
"lessThan": "2674d603a9e6970463b2b9ebcf8e31e90beae169",
"status": "affected",
"version": "fdeea7be88b12742bfd50d9e19a06c0d2e702400",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/vrf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvrf: Fix a potential NPD when removing a port from a VRF\n\nRCU readers that identified a net device as a VRF port using\nnetif_is_l3_slave() assume that a subsequent call to\nnetdev_master_upper_dev_get_rcu() will return a VRF device. They then\ncontinue to dereference its l3mdev operations.\n\nThis assumption is not always correct and can result in a NPD [1]. There\nis no RCU synchronization when removing a port from a VRF, so it is\npossible for an RCU reader to see a new master device (e.g., a bridge)\nthat does not have l3mdev operations.\n\nFix by adding RCU synchronization after clearing the IFF_L3MDEV_SLAVE\nflag. Skip this synchronization when a net device is removed from a VRF\nas part of its deletion and when the VRF device itself is deleted. In\nthe latter case an RCU grace period will pass by the time RTNL is\nreleased.\n\n[1]\nBUG: kernel NULL pointer dereference, address: 0000000000000000\n[...]\nRIP: 0010:l3mdev_fib_table_rcu (net/l3mdev/l3mdev.c:181)\n[...]\nCall Trace:\n\u003cTASK\u003e\nl3mdev_fib_table_by_index (net/l3mdev/l3mdev.c:201 net/l3mdev/l3mdev.c:189)\n__inet_bind (net/ipv4/af_inet.c:499 (discriminator 3))\ninet_bind_sk (net/ipv4/af_inet.c:469)\n__sys_bind (./include/linux/file.h:62 (discriminator 1) ./include/linux/file.h:83 (discriminator 1) net/socket.c:1951 (discriminator 1))\n__x64_sys_bind (net/socket.c:1969 (discriminator 1) net/socket.c:1967 (discriminator 1) net/socket.c:1967 (discriminator 1))\ndo_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T07:14:19.351Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2c022f582fd16a470df6ed9e7fb7e9fc48946d49"
},
{
"url": "https://git.kernel.org/stable/c/4ab6fc60ed5a0344b60711b09bff1dc238d8d6a4"
},
{
"url": "https://git.kernel.org/stable/c/468defa0b70902a22f4478c1207624bc1b31c124"
},
{
"url": "https://git.kernel.org/stable/c/3db8d078f7f652379ee394132b169d304f6eb4c1"
},
{
"url": "https://git.kernel.org/stable/c/8c2b792f04a3db97c9d8d2a45817e93f8884baf5"
},
{
"url": "https://git.kernel.org/stable/c/a7a97f2303e63ede105c1d55ef53dc497364e11d"
},
{
"url": "https://git.kernel.org/stable/c/d47204c127992da0c976ac9747070a575912e0fe"
},
{
"url": "https://git.kernel.org/stable/c/2674d603a9e6970463b2b9ebcf8e31e90beae169"
}
],
"title": "vrf: Fix a potential NPD when removing a port from a VRF",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52925",
"datePublished": "2026-06-24T07:14:19.351Z",
"dateReserved": "2026-06-09T07:44:35.368Z",
"dateUpdated": "2026-06-24T07:14:19.351Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52908 (GCVE-0-2026-52908)
Vulnerability from cvelistv5
Published
2026-06-19 14:00
Modified
2026-08-05 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA: During rereg_mr ensure that REREG_ACCESS is compatible
If IB_MR_REREG_ACCESS changes from RO to RW then the umem has to be
re-evaluated to ensure it is properly pinned as RW. Since the umem is
hidden inside each driver's mr struct add a ib_umem_check_rereg() function
that each driver has to call before processing IB_MR_REREG_ACCESS.
mlx4 has to retain its duplicate ib_access_writable check because it
implements IB_MR_REREG_ACCESS | IB_MR_REREG_TRANS by changing both items
in place sequentially while the MR is live, so it will continue to not
support this combination.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/umem.c",
"drivers/infiniband/hw/hns/hns_roce_mr.c",
"drivers/infiniband/hw/irdma/verbs.c",
"drivers/infiniband/hw/mlx4/mr.c",
"drivers/infiniband/hw/mlx5/mr.c",
"drivers/infiniband/sw/rxe/rxe_verbs.c",
"include/rdma/ib_umem.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "09dc18894148381d3bfc550083b1236043870dce",
"status": "affected",
"version": "b40656aa7d559adc1fe689396dc58b92a9a27286",
"versionType": "git"
},
{
"lessThan": "eba5df21eda0fe7418efbea2f799f8ea1b8ca94c",
"status": "affected",
"version": "b40656aa7d559adc1fe689396dc58b92a9a27286",
"versionType": "git"
},
{
"lessThan": "2904e985a2917b5dac65df82733065e78a65fc9d",
"status": "affected",
"version": "b40656aa7d559adc1fe689396dc58b92a9a27286",
"versionType": "git"
},
{
"lessThan": "50334a05a950840b39a1ce3d2a173b4183db9b3e",
"status": "affected",
"version": "b40656aa7d559adc1fe689396dc58b92a9a27286",
"versionType": "git"
},
{
"lessThan": "badad6fad60def1b9805559dd81dbab3d97b82aa",
"status": "affected",
"version": "b40656aa7d559adc1fe689396dc58b92a9a27286",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/umem.c",
"drivers/infiniband/hw/hns/hns_roce_mr.c",
"drivers/infiniband/hw/irdma/verbs.c",
"drivers/infiniband/hw/mlx4/mr.c",
"drivers/infiniband/hw/mlx5/mr.c",
"drivers/infiniband/sw/rxe/rxe_verbs.c",
"include/rdma/ib_umem.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA: During rereg_mr ensure that REREG_ACCESS is compatible\n\nIf IB_MR_REREG_ACCESS changes from RO to RW then the umem has to be\nre-evaluated to ensure it is properly pinned as RW. Since the umem is\nhidden inside each driver\u0027s mr struct add a ib_umem_check_rereg() function\nthat each driver has to call before processing IB_MR_REREG_ACCESS.\n\nmlx4 has to retain its duplicate ib_access_writable check because it\nimplements IB_MR_REREG_ACCESS | IB_MR_REREG_TRANS by changing both items\nin place sequentially while the MR is live, so it will continue to not\nsupport this combination."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local RDMA uverbs write/ioctl operations on /dev/infiniband/uverbs*, not by unauthenticated network packets. Remote RDMA traffic may perform the final write only after a local process has created and reregistered the MR.\nAC:L - The trigger is a deterministic sequence: register an MR read-only, reregister it with writable access without changing translation, then use the writable MR. There is no race or attacker-uncontrolled timing requirement.\nPR:L - A basic local user can open the uverbs device when an RDMA device is exposed and create the required context, PD, and MR; the path has no CAP_SYS_ADMIN or CAP_NET_ADMIN gate. Resource limits may constrain size but do not make the attack require administrator privileges.\nUI:N - No victim action is required after the attacker has local execution and access to the RDMA uverbs device. The attacker drives the registration, reregistration, and write operations directly.\nS:U - The impact remains within the kernel/host security authority and is a local privilege escalation or host integrity violation. It does not inherently cross a VM, hypervisor, or IOMMU security boundary.\nC:H - The stale read-only pin can be converted into a writable RDMA mapping, enabling modification of read-only/COW or page-cache backed memory in a Dirty-COW-like way. A plausible privileged-code-execution path through corrupted executable page cache yields full confidentiality impact.\nI:H - The bug creates an unauthorized write primitive to pages that were not pinned with FOLL_WRITE and should not be writable. This can corrupt read-only user mappings or shared page-cache contents, making high integrity impact defensible.\nA:H - The same unauthorized write primitive can corrupt executable/library page cache or process memory and crash privileged services or destabilize the system. With plausible root code execution, high availability impact is also defensible."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:31.552Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/09dc18894148381d3bfc550083b1236043870dce"
},
{
"url": "https://git.kernel.org/stable/c/eba5df21eda0fe7418efbea2f799f8ea1b8ca94c"
},
{
"url": "https://git.kernel.org/stable/c/2904e985a2917b5dac65df82733065e78a65fc9d"
},
{
"url": "https://git.kernel.org/stable/c/50334a05a950840b39a1ce3d2a173b4183db9b3e"
},
{
"url": "https://git.kernel.org/stable/c/badad6fad60def1b9805559dd81dbab3d97b82aa"
}
],
"title": "RDMA: During rereg_mr ensure that REREG_ACCESS is compatible",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52908",
"datePublished": "2026-06-19T14:00:35.971Z",
"dateReserved": "2026-06-09T07:44:35.366Z",
"dateUpdated": "2026-08-05T12:31:31.552Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53022 (GCVE-0-2026-53022)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-06-24 16:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: dell-wmi-sysman: bound enumeration string aggregation
populate_enum_data() aggregates firmware-provided value-modifier
and possible-value strings into fixed 512-byte struct members.
The current code bounds each individual source string but then
appends every string and separator with raw strcat() and no
remaining-space check.
Switch the aggregation loops to a bounded append helper and
reject enumeration packages whose combined strings do not fit
in the destination buffers.
[ij: add include]
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e8a60aa7404bfef37705da5607c97737073ac38d Version: e8a60aa7404bfef37705da5607c97737073ac38d Version: e8a60aa7404bfef37705da5607c97737073ac38d Version: e8a60aa7404bfef37705da5607c97737073ac38d Version: e8a60aa7404bfef37705da5607c97737073ac38d Version: e8a60aa7404bfef37705da5607c97737073ac38d Version: e8a60aa7404bfef37705da5607c97737073ac38d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7b3dc1f764bf24eb99474a5de8173b0b43a8b071",
"status": "affected",
"version": "e8a60aa7404bfef37705da5607c97737073ac38d",
"versionType": "git"
},
{
"lessThan": "75c738d4f27fa18a2a033de153bd40302bde6a66",
"status": "affected",
"version": "e8a60aa7404bfef37705da5607c97737073ac38d",
"versionType": "git"
},
{
"lessThan": "ba0843c1955864401295f7ba3b420afe19f2266d",
"status": "affected",
"version": "e8a60aa7404bfef37705da5607c97737073ac38d",
"versionType": "git"
},
{
"lessThan": "5a04f9a36930792f6d64e28d43609e158d09b665",
"status": "affected",
"version": "e8a60aa7404bfef37705da5607c97737073ac38d",
"versionType": "git"
},
{
"lessThan": "c5683ca4949a514fbe656c6d0d08c4c126e21db9",
"status": "affected",
"version": "e8a60aa7404bfef37705da5607c97737073ac38d",
"versionType": "git"
},
{
"lessThan": "90b118d264845f7aaf539ac49f7c75f1f29590e2",
"status": "affected",
"version": "e8a60aa7404bfef37705da5607c97737073ac38d",
"versionType": "git"
},
{
"lessThan": "3c34471c26abc52a37f5ad90949e2e4b8027eb14",
"status": "affected",
"version": "e8a60aa7404bfef37705da5607c97737073ac38d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: dell-wmi-sysman: bound enumeration string aggregation\n\npopulate_enum_data() aggregates firmware-provided value-modifier\nand possible-value strings into fixed 512-byte struct members.\nThe current code bounds each individual source string but then\nappends every string and separator with raw strcat() and no\nremaining-space check.\n\nSwitch the aggregation loops to a bounded append helper and\nreject enumeration packages whose combined strings do not fit\nin the destination buffers.\n\n[ij: add include]"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:29:31.552Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7b3dc1f764bf24eb99474a5de8173b0b43a8b071"
},
{
"url": "https://git.kernel.org/stable/c/75c738d4f27fa18a2a033de153bd40302bde6a66"
},
{
"url": "https://git.kernel.org/stable/c/ba0843c1955864401295f7ba3b420afe19f2266d"
},
{
"url": "https://git.kernel.org/stable/c/5a04f9a36930792f6d64e28d43609e158d09b665"
},
{
"url": "https://git.kernel.org/stable/c/c5683ca4949a514fbe656c6d0d08c4c126e21db9"
},
{
"url": "https://git.kernel.org/stable/c/90b118d264845f7aaf539ac49f7c75f1f29590e2"
},
{
"url": "https://git.kernel.org/stable/c/3c34471c26abc52a37f5ad90949e2e4b8027eb14"
}
],
"title": "platform/x86: dell-wmi-sysman: bound enumeration string aggregation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53022",
"datePublished": "2026-06-24T16:29:31.552Z",
"dateReserved": "2026-06-09T07:44:35.379Z",
"dateUpdated": "2026-06-24T16:29:31.552Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53073 (GCVE-0-2026-53073)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-06-24 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error
When hci_register_dev() fails in hci_uart_register_dev()
HCI_UART_PROTO_INIT is not cleared before calling hu->proto->close(hu)
and setting hu->hdev to NULL. This means incoming UART data will reach
the protocol-specific recv handler in hci_uart_tty_receive() after
resources are freed.
Clear HCI_UART_PROTO_INIT with a write lock before calling
hu->proto->close() and setting hu->hdev to NULL. The write lock ensures
all active readers have completed and no new reader can enter the
protocol recv path before resources are freed.
This allows the protocol-specific recv functions to remove the
"HCI_UART_REGISTERED" guard without risking a null pointer dereference
if hci_register_dev() fails.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a40f94f7caa8d3421b64f63ac31bc0f24c890f39 Version: 9e5a0f5777162e503400c70c6ed25fbbe2d38799 Version: 80f14e9de6a43a0bd8194cad1003a3e6dcbc3984 Version: 02e1bcdfdf769974e7e9fa285e295cd9852e2a38 Version: 281782d2c6730241e300d630bb9f200d831ede71 Version: 5df5dafc171b90d0b8d51547a82657cd5a1986c7 Version: 5df5dafc171b90d0b8d51547a82657cd5a1986c7 Version: 5df5dafc171b90d0b8d51547a82657cd5a1986c7 Version: 1dcf08fcff5ca529de6dc0395091f28854f4e54a Version: 8e5aff600539e5faea294d9612cca50220e602b8 Version: db7509fa110dd9b11134b75894677f30353b2c51 Version: 5.10.237 ≤ Version: 5.15.181 ≤ Version: 6.1.135 ≤ Version: 6.6.88 ≤ Version: 6.12.24 ≤ Version: 5.4.293 ≤ Version: 6.13.12 ≤ Version: 6.14.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/hci_ldisc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ebb39b2d81731b83ee71a1ba6dd0291a57b5ac07",
"status": "affected",
"version": "a40f94f7caa8d3421b64f63ac31bc0f24c890f39",
"versionType": "git"
},
{
"lessThan": "ed4033fb85ccaaf6c3983be3c7b037e48253d232",
"status": "affected",
"version": "9e5a0f5777162e503400c70c6ed25fbbe2d38799",
"versionType": "git"
},
{
"lessThan": "356dee1bcac4d0d9152390561fa63331ebff211b",
"status": "affected",
"version": "80f14e9de6a43a0bd8194cad1003a3e6dcbc3984",
"versionType": "git"
},
{
"lessThan": "a673cf6c4ac702cb79ac1f4d7fc4de763a6a3e40",
"status": "affected",
"version": "02e1bcdfdf769974e7e9fa285e295cd9852e2a38",
"versionType": "git"
},
{
"lessThan": "f4b69c35813c432973d340d3600c01de106ed474",
"status": "affected",
"version": "281782d2c6730241e300d630bb9f200d831ede71",
"versionType": "git"
},
{
"lessThan": "3daa5818e473ed60eb69d8b5c71b651909d28c5a",
"status": "affected",
"version": "5df5dafc171b90d0b8d51547a82657cd5a1986c7",
"versionType": "git"
},
{
"lessThan": "194f029a4d7f739e44ebc1f473120187b4de5104",
"status": "affected",
"version": "5df5dafc171b90d0b8d51547a82657cd5a1986c7",
"versionType": "git"
},
{
"lessThan": "68d39ea5e0adc9ecaea1ce8abd842ec972eb8718",
"status": "affected",
"version": "5df5dafc171b90d0b8d51547a82657cd5a1986c7",
"versionType": "git"
},
{
"status": "affected",
"version": "1dcf08fcff5ca529de6dc0395091f28854f4e54a",
"versionType": "git"
},
{
"status": "affected",
"version": "8e5aff600539e5faea294d9612cca50220e602b8",
"versionType": "git"
},
{
"status": "affected",
"version": "db7509fa110dd9b11134b75894677f30353b2c51",
"versionType": "git"
},
{
"lessThan": "5.10.258",
"status": "affected",
"version": "5.10.237",
"versionType": "semver"
},
{
"lessThan": "5.15.209",
"status": "affected",
"version": "5.15.181",
"versionType": "semver"
},
{
"lessThan": "6.1.175",
"status": "affected",
"version": "6.1.135",
"versionType": "semver"
},
{
"lessThan": "6.6.141",
"status": "affected",
"version": "6.6.88",
"versionType": "semver"
},
{
"lessThan": "6.12.91",
"status": "affected",
"version": "6.12.24",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.293",
"versionType": "semver"
},
{
"lessThan": "6.14",
"status": "affected",
"version": "6.13.12",
"versionType": "semver"
},
{
"lessThan": "6.15",
"status": "affected",
"version": "6.14.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/hci_ldisc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.10.237",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.15.181",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1.135",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "6.6.88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.12.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.293",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.14.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error\n\nWhen hci_register_dev() fails in hci_uart_register_dev()\nHCI_UART_PROTO_INIT is not cleared before calling hu-\u003eproto-\u003eclose(hu)\nand setting hu-\u003ehdev to NULL. This means incoming UART data will reach\nthe protocol-specific recv handler in hci_uart_tty_receive() after\nresources are freed.\n\nClear HCI_UART_PROTO_INIT with a write lock before calling\nhu-\u003eproto-\u003eclose() and setting hu-\u003ehdev to NULL. The write lock ensures\nall active readers have completed and no new reader can enter the\nprotocol recv path before resources are freed.\n\nThis allows the protocol-specific recv functions to remove the\n\"HCI_UART_REGISTERED\" guard without risking a null pointer dereference\nif hci_register_dev() fails."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:14.463Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ebb39b2d81731b83ee71a1ba6dd0291a57b5ac07"
},
{
"url": "https://git.kernel.org/stable/c/ed4033fb85ccaaf6c3983be3c7b037e48253d232"
},
{
"url": "https://git.kernel.org/stable/c/356dee1bcac4d0d9152390561fa63331ebff211b"
},
{
"url": "https://git.kernel.org/stable/c/a673cf6c4ac702cb79ac1f4d7fc4de763a6a3e40"
},
{
"url": "https://git.kernel.org/stable/c/f4b69c35813c432973d340d3600c01de106ed474"
},
{
"url": "https://git.kernel.org/stable/c/3daa5818e473ed60eb69d8b5c71b651909d28c5a"
},
{
"url": "https://git.kernel.org/stable/c/194f029a4d7f739e44ebc1f473120187b4de5104"
},
{
"url": "https://git.kernel.org/stable/c/68d39ea5e0adc9ecaea1ce8abd842ec972eb8718"
}
],
"title": "Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53073",
"datePublished": "2026-06-24T16:30:14.463Z",
"dateReserved": "2026-06-09T07:44:35.383Z",
"dateUpdated": "2026-06-24T16:30:14.463Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53072 (GCVE-0-2026-53072)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER
When protocol sets HCI_PROTO_DEFER, hci_conn_request_evt() calls
hci_connect_cfm(conn) without hdev->lock. Generally hci_connect_cfm()
assumes it is held, and if conn is deleted concurrently -> UAF.
Only SCO and ISO set HCI_PROTO_DEFER and only for defer setup listen,
and HCI_EV_CONN_REQUEST is not generated for ISO. In the non-deferred
listening socket code paths, hci_connect_cfm(conn) is called with
hdev->lock held.
Fix by holding the lock.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 70c464256310e1c3716099b9d02ece4169272f73 Version: 70c464256310e1c3716099b9d02ece4169272f73 Version: 70c464256310e1c3716099b9d02ece4169272f73 Version: 70c464256310e1c3716099b9d02ece4169272f73 Version: 70c464256310e1c3716099b9d02ece4169272f73 Version: 70c464256310e1c3716099b9d02ece4169272f73 Version: 70c464256310e1c3716099b9d02ece4169272f73 Version: 70c464256310e1c3716099b9d02ece4169272f73 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_event.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "60e3f4ff02d1f2d55bfbf2ca32a97285a9771ee4",
"status": "affected",
"version": "70c464256310e1c3716099b9d02ece4169272f73",
"versionType": "git"
},
{
"lessThan": "9d4a6c0f43fc5e4d4f062e8e450e5483eb74176e",
"status": "affected",
"version": "70c464256310e1c3716099b9d02ece4169272f73",
"versionType": "git"
},
{
"lessThan": "c7777f534a8018ae4bb1c80d8925af4df588a314",
"status": "affected",
"version": "70c464256310e1c3716099b9d02ece4169272f73",
"versionType": "git"
},
{
"lessThan": "6b4d226d01ab7da0d2027a2a1e3a6079152e5065",
"status": "affected",
"version": "70c464256310e1c3716099b9d02ece4169272f73",
"versionType": "git"
},
{
"lessThan": "541d5bf9b5afaf41090b2a3aa7b47f2db2ff801f",
"status": "affected",
"version": "70c464256310e1c3716099b9d02ece4169272f73",
"versionType": "git"
},
{
"lessThan": "385b2d0468a0871fc716c549fa3b0c257c7dbcb3",
"status": "affected",
"version": "70c464256310e1c3716099b9d02ece4169272f73",
"versionType": "git"
},
{
"lessThan": "c27224daf0b08efbb2b24ed64b6139b294f5473a",
"status": "affected",
"version": "70c464256310e1c3716099b9d02ece4169272f73",
"versionType": "git"
},
{
"lessThan": "5c7209a341ff2ac338b2b0375c34a307b37c9ac2",
"status": "affected",
"version": "70c464256310e1c3716099b9d02ece4169272f73",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_event.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.17"
},
{
"lessThan": "3.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER\n\nWhen protocol sets HCI_PROTO_DEFER, hci_conn_request_evt() calls\nhci_connect_cfm(conn) without hdev-\u003elock. Generally hci_connect_cfm()\nassumes it is held, and if conn is deleted concurrently -\u003e UAF.\n\nOnly SCO and ISO set HCI_PROTO_DEFER and only for defer setup listen,\nand HCI_EV_CONN_REQUEST is not generated for ISO. In the non-deferred\nlistening socket code paths, hci_connect_cfm(conn) is called with\nhdev-\u003elock held.\n\nFix by holding the lock."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable path is reached through Bluetooth HCI connection request handling for incoming SCO/eSCO connections from a nearby Bluetooth peer, so exploitation requires adjacency to the target Bluetooth radio.\nAC:L - The attacker can repeatedly initiate deferred SCO/eSCO connection attempts and race connection teardown/cleanup; when uncertain for this race, the higher-severity low-complexity rating is appropriate.\nPR:N - The remote Bluetooth peer reaches the pre-authentication connection request path without local privileges or verified credentials; local deferred-listener configuration is an environmental precondition, not attacker privilege.\nUI:N - Once the target has a deferred SCO/eSCO listener, the attacker can trigger the vulnerable HCI event without requiring a victim to perform an action.\nS:U - The bug is in the kernel Bluetooth stack and impacts the same kernel security authority; it is not a VM, sandbox, or hardware boundary escape by itself.\nC:H - The flaw is a use-after-free of an hci_conn object, and kernel heap UAFs can be leveraged for memory disclosure primitives in a plausible exploitation scenario.\nI:H - The freed hci_conn contains pointers, callback state, and protocol data used by confirmation callbacks, making control-flow or arbitrary memory corruption a defensible high-integrity impact for a kernel UAF.\nA:H - Even without full exploitation, dereferencing a concurrently freed hci_conn can crash or destabilize the kernel, causing high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:06.917Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/60e3f4ff02d1f2d55bfbf2ca32a97285a9771ee4"
},
{
"url": "https://git.kernel.org/stable/c/9d4a6c0f43fc5e4d4f062e8e450e5483eb74176e"
},
{
"url": "https://git.kernel.org/stable/c/c7777f534a8018ae4bb1c80d8925af4df588a314"
},
{
"url": "https://git.kernel.org/stable/c/6b4d226d01ab7da0d2027a2a1e3a6079152e5065"
},
{
"url": "https://git.kernel.org/stable/c/541d5bf9b5afaf41090b2a3aa7b47f2db2ff801f"
},
{
"url": "https://git.kernel.org/stable/c/385b2d0468a0871fc716c549fa3b0c257c7dbcb3"
},
{
"url": "https://git.kernel.org/stable/c/c27224daf0b08efbb2b24ed64b6139b294f5473a"
},
{
"url": "https://git.kernel.org/stable/c/5c7209a341ff2ac338b2b0375c34a307b37c9ac2"
}
],
"title": "Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53072",
"datePublished": "2026-06-24T16:30:13.570Z",
"dateReserved": "2026-06-09T07:44:35.383Z",
"dateUpdated": "2026-08-05T12:33:06.917Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53075 (GCVE-0-2026-53075)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ppp: require CAP_NET_ADMIN in target netns for unattached ioctls
/dev/ppp open is currently authorized against file->f_cred->user_ns,
while unattached administrative ioctls operate on current->nsproxy->net_ns.
As a result, a local unprivileged user can create a new user namespace
with CLONE_NEWUSER, gain CAP_NET_ADMIN only in that new user namespace,
and still issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against
an inherited network namespace.
Require CAP_NET_ADMIN in the user namespace that owns the target network
namespace before handling unattached PPP administrative ioctls.
This preserves normal pppd operation in the network namespace it is
actually privileged in, while rejecting the userns-only inherited-netns
case.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 273ec51dd7ceaa76e038875d85061ec856d8905e Version: 273ec51dd7ceaa76e038875d85061ec856d8905e Version: 273ec51dd7ceaa76e038875d85061ec856d8905e Version: 273ec51dd7ceaa76e038875d85061ec856d8905e Version: 273ec51dd7ceaa76e038875d85061ec856d8905e Version: 273ec51dd7ceaa76e038875d85061ec856d8905e Version: 273ec51dd7ceaa76e038875d85061ec856d8905e Version: 273ec51dd7ceaa76e038875d85061ec856d8905e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ppp/ppp_generic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c9edd90c57ae23692fff6b049fdfa4572a9fd532",
"status": "affected",
"version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
"versionType": "git"
},
{
"lessThan": "5080e188c914110034bbc569d5cfa2f06204681d",
"status": "affected",
"version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
"versionType": "git"
},
{
"lessThan": "67e901e28d177ac9a9bed76d69ce3471e704a89e",
"status": "affected",
"version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
"versionType": "git"
},
{
"lessThan": "954745d0223e7caec917c0b2d1a889ff56fa6e54",
"status": "affected",
"version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
"versionType": "git"
},
{
"lessThan": "3b2c2157dc2afc5c17cd7238afefca92f1ef330e",
"status": "affected",
"version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
"versionType": "git"
},
{
"lessThan": "5013be175c7ffd8b39efbc3c9c4db5b10b85fea8",
"status": "affected",
"version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
"versionType": "git"
},
{
"lessThan": "1a8a51ce85075a56a743b6f142606dd2696a391c",
"status": "affected",
"version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
"versionType": "git"
},
{
"lessThan": "2bb6379416fd19f44c3423a00bfd8626259f6067",
"status": "affected",
"version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ppp/ppp_generic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.30"
},
{
"lessThan": "2.6.30",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.30",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nppp: require CAP_NET_ADMIN in target netns for unattached ioctls\n\n/dev/ppp open is currently authorized against file-\u003ef_cred-\u003euser_ns,\nwhile unattached administrative ioctls operate on current-\u003ensproxy-\u003enet_ns.\n\nAs a result, a local unprivileged user can create a new user namespace\nwith CLONE_NEWUSER, gain CAP_NET_ADMIN only in that new user namespace,\nand still issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against\nan inherited network namespace.\n\nRequire CAP_NET_ADMIN in the user namespace that owns the target network\nnamespace before handling unattached PPP administrative ioctls.\n\nThis preserves normal pppd operation in the network namespace it is\nactually privileged in, while rejecting the userns-only inherited-netns\ncase."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable PPP administrative ioctls are reached locally through `/dev/ppp` and the `ioctl` syscall, not by remote packets.\nAC:L - An attacker can deterministically create a user namespace, open `/dev/ppp`, and issue the unattached ioctls against the inherited target network namespace; no race or external condition is required.\nPR:L - A basic unprivileged local user can gain `CAP_NET_ADMIN` only inside a new user namespace and abuse the pre-fix check, so this does not require real root or host `CAP_NET_ADMIN`.\nUI:N - No victim action is required after the attacker has local code execution; the attacker directly invokes the namespace and ioctl operations.\nS:C - The bug crosses the user-namespace capability boundary by allowing capabilities in one user namespace to administer PPP resources in a network namespace owned by another user namespace.\nC:H - By attaching to existing PPP units or channels, an attacker can read PPP control/authentication traffic and can plausibly expose sensitive PPP-session data in affected deployments.\nI:H - The attacker can create PPP interfaces, attach to units/channels, alter PPP parameters, and inject or redirect PPP frames in a network namespace they should not administer.\nA:H - The attacker can disrupt PPP connectivity by changing interface/channel state, disconnecting or bridging channels, or exhausting PPP resources, causing loss of network availability in PPP-dependent systems."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:07.985Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c9edd90c57ae23692fff6b049fdfa4572a9fd532"
},
{
"url": "https://git.kernel.org/stable/c/5080e188c914110034bbc569d5cfa2f06204681d"
},
{
"url": "https://git.kernel.org/stable/c/67e901e28d177ac9a9bed76d69ce3471e704a89e"
},
{
"url": "https://git.kernel.org/stable/c/954745d0223e7caec917c0b2d1a889ff56fa6e54"
},
{
"url": "https://git.kernel.org/stable/c/3b2c2157dc2afc5c17cd7238afefca92f1ef330e"
},
{
"url": "https://git.kernel.org/stable/c/5013be175c7ffd8b39efbc3c9c4db5b10b85fea8"
},
{
"url": "https://git.kernel.org/stable/c/1a8a51ce85075a56a743b6f142606dd2696a391c"
},
{
"url": "https://git.kernel.org/stable/c/2bb6379416fd19f44c3423a00bfd8626259f6067"
}
],
"title": "ppp: require CAP_NET_ADMIN in target netns for unattached ioctls",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53075",
"datePublished": "2026-06-24T16:30:16.214Z",
"dateReserved": "2026-06-09T07:44:35.383Z",
"dateUpdated": "2026-08-05T12:33:07.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53059 (GCVE-0-2026-53059)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-08-26 12:04
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm log: fix out-of-bounds write due to region_count overflow
The local variable region_count in create_log_context() is declared as
unsigned int (32-bit), but dm_sector_div_up() returns sector_t (64-bit).
When a device-mapper target has a sufficiently large ti->len with a small
region_size, the division result can exceed UINT_MAX. The truncated
value is then used to calculate bitset_size, causing clean_bits,
sync_bits, and recovering_bits to be allocated far smaller than needed
for the actual number of regions.
Subsequent log operations (log_set_bit, log_clear_bit, log_test_bit) use
region indices derived from the full untruncated region space, causing
out-of-bounds writes to kernel heap memory allocated by vmalloc.
This can be reproduced by creating a mirror target whose region_count
overflows 32 bits:
dmsetup create bigzero --table '0 8589934594 zero'
dmsetup create mymirror --table '0 8589934594 mirror \
core 2 2 nosync 2 /dev/mapper/bigzero 0 \
/dev/mapper/bigzero 0'
The status output confirms the truncation (sync_count=1 instead of
4294967297, because 0x100000001 was truncated to 1):
$ dmsetup status mymirror
0 8589934594 mirror 2 254:1 254:1 1/4294967297 ...
This leads to a kernel crash in core_in_sync:
BUG: scheduling while atomic: (udev-worker)/9150/0x00000000
RIP: 0010:core_in_sync+0x14/0x30 [dm_log]
CR2: 0000000000000008
Fixing recursive fault but reboot is needed!
Fix by widening the local region_count to sector_t and adding an
explicit overflow check before the value is assigned to lc->region_count.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.39.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-55.98.1.el10_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.147.1.rt7.488.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.147.1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.200.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.200.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.206.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.206.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_tus:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.158.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.158.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.30.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.188.1.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.188.1.rt14.473.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-570.135.1.el9_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unknown",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s device-mapper log (dm log) component. A local attacker could exploit an integer overflow vulnerability where a 64-bit value is truncated to 32 bits, leading to undersized memory allocations. This allows for out-of-bounds writes to kernel memory during log operations. Successful exploitation of this flaw can cause a kernel crash, resulting in a Denial of Service (DoS) for the affected system."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T12:04:47.682Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-53059"
},
{
"name": "RHBZ#2492277",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492277"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53059.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:55445"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:45114"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:59662"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:56574"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:45192"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:45115"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47248"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:53989"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:52649"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:45116"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:59663"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:55445: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:45114: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:59662: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:56574: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:45192: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:45115: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:47248: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
},
{
"lang": "en",
"value": "RHSA-2026:53989: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:52649: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:45116: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:59663: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: dm log: fix out-of-bounds write due to region_count overflow",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-log.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "44ab8875ae4a2842bde2d756bed195d375e0debb",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "defe483e47173768c227532694dc78cb65db5f09",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "3ec74da927b4e171a6fc0e77b1188ba4d019af51",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d4ac87567f86a55c3c92e9a5144dcd943a9772a1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "12bd5b88e91a02785244ff1d20fb157e96e9cdc8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "b455903eed4558982be0811f5b7f44f6bbc4ff57",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "4ec8323b9f0764a14d532b1ae9b87f8a9fecb867",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "c20e36b7631d83e7535877f08af8b0af72c44b1a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-log.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm log: fix out-of-bounds write due to region_count overflow\n\nThe local variable region_count in create_log_context() is declared as\nunsigned int (32-bit), but dm_sector_div_up() returns sector_t (64-bit).\nWhen a device-mapper target has a sufficiently large ti-\u003elen with a small\nregion_size, the division result can exceed UINT_MAX. The truncated\nvalue is then used to calculate bitset_size, causing clean_bits,\nsync_bits, and recovering_bits to be allocated far smaller than needed\nfor the actual number of regions.\n\nSubsequent log operations (log_set_bit, log_clear_bit, log_test_bit) use\nregion indices derived from the full untruncated region space, causing\nout-of-bounds writes to kernel heap memory allocated by vmalloc.\n\nThis can be reproduced by creating a mirror target whose region_count\noverflows 32 bits:\n\n dmsetup create bigzero --table \u00270 8589934594 zero\u0027\n dmsetup create mymirror --table \u00270 8589934594 mirror \\\n core 2 2 nosync 2 /dev/mapper/bigzero 0 \\\n /dev/mapper/bigzero 0\u0027\n\nThe status output confirms the truncation (sync_count=1 instead of\n4294967297, because 0x100000001 was truncated to 1):\n\n $ dmsetup status mymirror\n 0 8589934594 mirror 2 254:1 254:1 1/4294967297 ...\n\nThis leads to a kernel crash in core_in_sync:\n\n BUG: scheduling while atomic: (udev-worker)/9150/0x00000000\n RIP: 0010:core_in_sync+0x14/0x30 [dm_log]\n CR2: 0000000000000008\n Fixing recursive fault but reboot is needed!\n\nFix by widening the local region_count to sector_t and adding an\nexplicit overflow check before the value is assigned to lc-\u003eregion_count."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:04.210Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/44ab8875ae4a2842bde2d756bed195d375e0debb"
},
{
"url": "https://git.kernel.org/stable/c/defe483e47173768c227532694dc78cb65db5f09"
},
{
"url": "https://git.kernel.org/stable/c/3ec74da927b4e171a6fc0e77b1188ba4d019af51"
},
{
"url": "https://git.kernel.org/stable/c/d4ac87567f86a55c3c92e9a5144dcd943a9772a1"
},
{
"url": "https://git.kernel.org/stable/c/12bd5b88e91a02785244ff1d20fb157e96e9cdc8"
},
{
"url": "https://git.kernel.org/stable/c/b455903eed4558982be0811f5b7f44f6bbc4ff57"
},
{
"url": "https://git.kernel.org/stable/c/4ec8323b9f0764a14d532b1ae9b87f8a9fecb867"
},
{
"url": "https://git.kernel.org/stable/c/c20e36b7631d83e7535877f08af8b0af72c44b1a"
}
],
"title": "dm log: fix out-of-bounds write due to region_count overflow",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53059",
"datePublished": "2026-06-24T16:30:04.210Z",
"dateReserved": "2026-06-09T07:44:35.382Z",
"dateUpdated": "2026-08-26T12:04:47.682Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53062 (GCVE-0-2026-53062)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm cache policy smq: fix missing locks in invalidating cache blocks
In passthrough mode, the policy invalidate_mapping operation is called
simultaneously from multiple workers, thus it should be protected by a
lock. Otherwise, we might end up with data races on the allocated blocks
counter, or even use-after-free issues with internal data structures
when doing concurrent writes.
Note that the existing FIXME in smq_invalidate_mapping() doesn't affect
passthrough mode since migration tasks don't exist there, but would need
attention if supporting fast device shrinking via suspend/resume without
target reloading.
Reproduce steps:
1. Create a cache device consisting of 1024 cache entries
dmsetup create cmeta --table "0 8192 linear /dev/sdc 0"
dmsetup create cdata --table "0 131072 linear /dev/sdc 8192"
dmsetup create corig --table "0 262144 linear /dev/sdc 262144"
dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct
dmsetup create cache --table "0 262144 cache /dev/mapper/cmeta \
/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0"
2. Populate the cache, and record the number of cached blocks
fio --name=populate --filename=/dev/mapper/cache --rw=randwrite --bs=4k \
--size=64m --direct=1
nr_cached=$(dmsetup status cache | awk '{split($7, a, "/"); print a[1]}')
3. Reload the cache into passthrough mode
dmsetup suspend cache
dmsetup reload cache --table "0 262144 cache /dev/mapper/cmeta \
/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0"
dmsetup resume cache
4. Write to the passthrough cache. By setting multiple jobs with I/O
size equal to the cache block size, cache blocks are invalidated
concurrently from different workers.
fio --filename=/dev/mapper/cache --name=test --rw=randwrite --bs=64k \
--direct=1 --numjobs=2 --randrepeat=0 --size=64m
5. Check if demoted matches cached block count. These numbers should
match but may differ due to the data race.
nr_demoted=$(dmsetup status cache | awk '{print $12}')
echo "$nr_cached, $nr_demoted"
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b29d4986d0da1a27cd35917cdb433672f5c95d7f Version: b29d4986d0da1a27cd35917cdb433672f5c95d7f Version: b29d4986d0da1a27cd35917cdb433672f5c95d7f Version: b29d4986d0da1a27cd35917cdb433672f5c95d7f Version: b29d4986d0da1a27cd35917cdb433672f5c95d7f Version: b29d4986d0da1a27cd35917cdb433672f5c95d7f Version: b29d4986d0da1a27cd35917cdb433672f5c95d7f Version: b29d4986d0da1a27cd35917cdb433672f5c95d7f |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-cache-policy-smq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4991b5a08751e2e82488fb93ae08849b6aea10d9",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "1b2bec4a7dcf5f00b7a1cbeeec8997841d783513",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "9a5fdfb9e57ec3a8ad2b8fce5e5ffa42d53b130e",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "ac5ee99443891bdb161f5539606a66a1b5e72542",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "93627a29d4b66d4a2def938dfb8610cc80ae454b",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "c348ae47d8e65f06429fa41adce9ad986b696766",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "2b62d0611c9af14a16bddf22df2612b4f40eb5a1",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "2d1f7b65f5deedd2e6b09fdc6ea27f8375f24b45",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-cache-policy-smq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm cache policy smq: fix missing locks in invalidating cache blocks\n\nIn passthrough mode, the policy invalidate_mapping operation is called\nsimultaneously from multiple workers, thus it should be protected by a\nlock. Otherwise, we might end up with data races on the allocated blocks\ncounter, or even use-after-free issues with internal data structures\nwhen doing concurrent writes.\n\nNote that the existing FIXME in smq_invalidate_mapping() doesn\u0027t affect\npassthrough mode since migration tasks don\u0027t exist there, but would need\nattention if supporting fast device shrinking via suspend/resume without\ntarget reloading.\n\nReproduce steps:\n\n1. Create a cache device consisting of 1024 cache entries\n\ndmsetup create cmeta --table \"0 8192 linear /dev/sdc 0\"\ndmsetup create cdata --table \"0 131072 linear /dev/sdc 8192\"\ndmsetup create corig --table \"0 262144 linear /dev/sdc 262144\"\ndd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct\ndmsetup create cache --table \"0 262144 cache /dev/mapper/cmeta \\\n/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0\"\n\n2. Populate the cache, and record the number of cached blocks\n\nfio --name=populate --filename=/dev/mapper/cache --rw=randwrite --bs=4k \\\n--size=64m --direct=1\nnr_cached=$(dmsetup status cache | awk \u0027{split($7, a, \"/\"); print a[1]}\u0027)\n\n3. Reload the cache into passthrough mode\n\ndmsetup suspend cache\ndmsetup reload cache --table \"0 262144 cache /dev/mapper/cmeta \\\n/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0\"\ndmsetup resume cache\n\n4. Write to the passthrough cache. By setting multiple jobs with I/O\n size equal to the cache block size, cache blocks are invalidated\n concurrently from different workers.\n\nfio --filename=/dev/mapper/cache --name=test --rw=randwrite --bs=64k \\\n--direct=1 --numjobs=2 --randrepeat=0 --size=64m\n\n5. Check if demoted matches cached block count. These numbers should\n match but may differ due to the data race.\n\nnr_demoted=$(dmsetup status cache | awk \u0027{print $12}\u0027)\necho \"$nr_cached, $nr_demoted\""
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local block I/O to an existing dm-cache mapped device, such as writes from a mounted filesystem or direct writes to the block device. It is not reachable through a network packet path.\nAC:L - Once the dm-cache target is in passthrough mode with clean cached mappings, the attacker can trigger the race by issuing concurrent writes and controls both racing sides. No uncontrollable timing condition beyond ordinary concurrent I/O is required.\nPR:L - Creating or reloading the dm-cache target requires CAP_SYS_ADMIN, but in a reasonable deployed scenario an unprivileged local user with write access to a filesystem backed by the existing target can submit the writes that reach the vulnerable code. Device-mapper control ioctls are not reachable through unprivileged user namespaces.\nUI:N - The attacker only needs to issue local writes; no separate victim action is required.\nS:U - The corruption occurs inside the same kernel and block-device security authority. This is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The missing locking can produce use-after-free style reuse and corruption of SMQ internal mapping structures. Following the higher-severity rule for kernel memory corruption, this is treated as capable of enabling high-impact information disclosure.\nI:H - The race can corrupt cache policy queues/hash tables and freed/reused mapping entries, affecting kernel control/data structures and potentially cache block mapping integrity. This is memory corruption/use-after-free class behavior, so high integrity impact is defensible.\nA:H - The race can trigger double-free/allocation checks, corrupted queues/hash state, NULL-deref-adjacent failures in the same passthrough write path, or kernel oops/panic. Repeated concurrent writes can therefore cause high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:01.533Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4991b5a08751e2e82488fb93ae08849b6aea10d9"
},
{
"url": "https://git.kernel.org/stable/c/1b2bec4a7dcf5f00b7a1cbeeec8997841d783513"
},
{
"url": "https://git.kernel.org/stable/c/9a5fdfb9e57ec3a8ad2b8fce5e5ffa42d53b130e"
},
{
"url": "https://git.kernel.org/stable/c/ac5ee99443891bdb161f5539606a66a1b5e72542"
},
{
"url": "https://git.kernel.org/stable/c/93627a29d4b66d4a2def938dfb8610cc80ae454b"
},
{
"url": "https://git.kernel.org/stable/c/c348ae47d8e65f06429fa41adce9ad986b696766"
},
{
"url": "https://git.kernel.org/stable/c/2b62d0611c9af14a16bddf22df2612b4f40eb5a1"
},
{
"url": "https://git.kernel.org/stable/c/2d1f7b65f5deedd2e6b09fdc6ea27f8375f24b45"
}
],
"title": "dm cache policy smq: fix missing locks in invalidating cache blocks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53062",
"datePublished": "2026-06-24T16:30:06.189Z",
"dateReserved": "2026-06-09T07:44:35.382Z",
"dateUpdated": "2026-08-05T12:33:01.533Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53037 (GCVE-0-2026-53037)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-06-24 16:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: usbhid: fix deadlock in hid_post_reset()
You can build a USB device that includes a HID component
and a storage or UAS component. The components can be reset
only together. That means that hid_pre_reset() and hid_post_reset()
are in the block IO error handling. Hence no memory allocation
used in them may do block IO because the IO can deadlock
on the mutex held while resetting a device and calling the
interface drivers.
Use GFP_NOIO for all allocations in them.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: dc3c78e43469063c5bf4b744214508f94c4129f9 Version: dc3c78e43469063c5bf4b744214508f94c4129f9 Version: dc3c78e43469063c5bf4b744214508f94c4129f9 Version: dc3c78e43469063c5bf4b744214508f94c4129f9 Version: dc3c78e43469063c5bf4b744214508f94c4129f9 Version: dc3c78e43469063c5bf4b744214508f94c4129f9 Version: dc3c78e43469063c5bf4b744214508f94c4129f9 Version: dc3c78e43469063c5bf4b744214508f94c4129f9 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/usbhid/hid-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "56d318ef8766f0deb08517fd8f3007256ea7997d",
"status": "affected",
"version": "dc3c78e43469063c5bf4b744214508f94c4129f9",
"versionType": "git"
},
{
"lessThan": "90550af0aad5e75110073c501e4fb42fca20ff80",
"status": "affected",
"version": "dc3c78e43469063c5bf4b744214508f94c4129f9",
"versionType": "git"
},
{
"lessThan": "eeceb6f4dd42065fdda3a526a93d08b8fb90fb69",
"status": "affected",
"version": "dc3c78e43469063c5bf4b744214508f94c4129f9",
"versionType": "git"
},
{
"lessThan": "ad4505d2ab3aaac6498f17649608e70e80034bf2",
"status": "affected",
"version": "dc3c78e43469063c5bf4b744214508f94c4129f9",
"versionType": "git"
},
{
"lessThan": "4e900465296ce9fb12ed47dc77389b8dde95bfe0",
"status": "affected",
"version": "dc3c78e43469063c5bf4b744214508f94c4129f9",
"versionType": "git"
},
{
"lessThan": "c7abd0e6c87441e99c759d40eb6fe589634e3041",
"status": "affected",
"version": "dc3c78e43469063c5bf4b744214508f94c4129f9",
"versionType": "git"
},
{
"lessThan": "b3d16611d7cd78e9d5c6baa19b61b7caf9f1ab5e",
"status": "affected",
"version": "dc3c78e43469063c5bf4b744214508f94c4129f9",
"versionType": "git"
},
{
"lessThan": "8df2c1b47ee3cd50fd454f75c7a7e2ae8a6adf72",
"status": "affected",
"version": "dc3c78e43469063c5bf4b744214508f94c4129f9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/usbhid/hid-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.5"
},
{
"lessThan": "3.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: usbhid: fix deadlock in hid_post_reset()\n\nYou can build a USB device that includes a HID component\nand a storage or UAS component. The components can be reset\nonly together. That means that hid_pre_reset() and hid_post_reset()\nare in the block IO error handling. Hence no memory allocation\nused in them may do block IO because the IO can deadlock\non the mutex held while resetting a device and calling the\ninterface drivers.\nUse GFP_NOIO for all allocations in them."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:29:44.311Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/56d318ef8766f0deb08517fd8f3007256ea7997d"
},
{
"url": "https://git.kernel.org/stable/c/90550af0aad5e75110073c501e4fb42fca20ff80"
},
{
"url": "https://git.kernel.org/stable/c/eeceb6f4dd42065fdda3a526a93d08b8fb90fb69"
},
{
"url": "https://git.kernel.org/stable/c/ad4505d2ab3aaac6498f17649608e70e80034bf2"
},
{
"url": "https://git.kernel.org/stable/c/4e900465296ce9fb12ed47dc77389b8dde95bfe0"
},
{
"url": "https://git.kernel.org/stable/c/c7abd0e6c87441e99c759d40eb6fe589634e3041"
},
{
"url": "https://git.kernel.org/stable/c/b3d16611d7cd78e9d5c6baa19b61b7caf9f1ab5e"
},
{
"url": "https://git.kernel.org/stable/c/8df2c1b47ee3cd50fd454f75c7a7e2ae8a6adf72"
}
],
"title": "HID: usbhid: fix deadlock in hid_post_reset()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53037",
"datePublished": "2026-06-24T16:29:44.311Z",
"dateReserved": "2026-06-09T07:44:35.380Z",
"dateUpdated": "2026-06-24T16:29:44.311Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52977 (GCVE-0-2026-52977)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-08-19 16:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
futex: Prevent lockup in requeue-PI during signal/ timeout wakeup
During wait-requeue-pi (task A) and requeue-PI (task B) the following
race can happen:
Task A Task B
futex_wait_requeue_pi()
futex_setup_timer()
futex_do_wait()
futex_requeue()
CLASS(hb, hb1)(&key1);
CLASS(hb, hb2)(&key2);
*timeout*
futex_requeue_pi_wakeup_sync()
requeue_state = Q_REQUEUE_PI_IGNORE
*blocks on hb->lock*
futex_proxy_trylock_atomic()
futex_requeue_pi_prepare()
Q_REQUEUE_PI_IGNORE => -EAGAIN
double_unlock_hb(hb1, hb2)
*retry*
Task B acquires both hb locks and attempts to acquire the PI-lock of the
top most waiter (task B). Task A is leaving early due to a signal/
timeout and started removing itself from the queue. It updates its
requeue_state but can not remove it from the list because this requires
the hb lock which is owned by task B.
Usually task A is able to swoop the lock after task B unlocked it.
However if task B is of higher priority then task A may not be able to
wake up in time and acquire the lock before task B gets it again.
Especially on a UP system where A is never scheduled.
As a result task A blocks on the lock and task B busy loops, trying to
make progress but live locks the system instead. Tragic.
This can be fixed by removing the top most waiter from the list in this
case. This allows task B to grab the next top waiter (if any) in the
next iteration and make progress.
Remove the top most waiter if futex_requeue_pi_prepare() fails.
Let the waiter conditionally remove itself from the list in
handle_early_requeue_pi_wakeup().
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 07d91ef510fb16a2e0ca7453222105835b7ba3b8 Version: 07d91ef510fb16a2e0ca7453222105835b7ba3b8 Version: 07d91ef510fb16a2e0ca7453222105835b7ba3b8 Version: 07d91ef510fb16a2e0ca7453222105835b7ba3b8 Version: 07d91ef510fb16a2e0ca7453222105835b7ba3b8 Version: 07d91ef510fb16a2e0ca7453222105835b7ba3b8 Version: 07d91ef510fb16a2e0ca7453222105835b7ba3b8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/futex/requeue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e5dbae3572757cecc3d3ec7cf96cbcc9cd9f016c",
"status": "affected",
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
"versionType": "git"
},
{
"lessThan": "4e0ed44e51727d56244a822ab941efe507c47966",
"status": "affected",
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
"versionType": "git"
},
{
"lessThan": "e3f95b1ba242e37093305812df7fdbe7288a43ac",
"status": "affected",
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
"versionType": "git"
},
{
"lessThan": "0aacb6d18f76552e3e0ee25d9f40d21b3486f4cf",
"status": "affected",
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
"versionType": "git"
},
{
"lessThan": "69a7cfc66405aeaa2483147653d031b3592ffc9c",
"status": "affected",
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
"versionType": "git"
},
{
"lessThan": "0304d60abb9dcc02bc7fe6d1850f4ca206e8f1a0",
"status": "affected",
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
"versionType": "git"
},
{
"lessThan": "bc7304f3ae20972d11db6e0b1b541c63feda5f05",
"status": "affected",
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/futex/requeue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Prevent lockup in requeue-PI during signal/ timeout wakeup\n\nDuring wait-requeue-pi (task A) and requeue-PI (task B) the following\nrace can happen:\n\n Task A Task B\n futex_wait_requeue_pi()\n futex_setup_timer()\n futex_do_wait()\n futex_requeue()\n CLASS(hb, hb1)(\u0026key1);\n CLASS(hb, hb2)(\u0026key2);\n *timeout*\n futex_requeue_pi_wakeup_sync()\n requeue_state = Q_REQUEUE_PI_IGNORE\n\n *blocks on hb-\u003elock*\n\n futex_proxy_trylock_atomic()\n futex_requeue_pi_prepare()\n Q_REQUEUE_PI_IGNORE =\u003e -EAGAIN\n double_unlock_hb(hb1, hb2)\n *retry*\n\nTask B acquires both hb locks and attempts to acquire the PI-lock of the\ntop most waiter (task B). Task A is leaving early due to a signal/\ntimeout and started removing itself from the queue. It updates its\nrequeue_state but can not remove it from the list because this requires\nthe hb lock which is owned by task B.\n\nUsually task A is able to swoop the lock after task B unlocked it.\nHowever if task B is of higher priority then task A may not be able to\nwake up in time and acquire the lock before task B gets it again.\nEspecially on a UP system where A is never scheduled.\n\nAs a result task A blocks on the lock and task B busy loops, trying to\nmake progress but live locks the system instead. Tragic.\n\nThis can be fixed by removing the top most waiter from the list in this\ncase. This allows task B to grab the next top waiter (if any) in the\nnext iteration and make progress.\n\nRemove the top most waiter if futex_requeue_pi_prepare() fails.\nLet the waiter conditionally remove itself from the list in\nhandle_early_requeue_pi_wakeup()."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:28:04.076Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e5dbae3572757cecc3d3ec7cf96cbcc9cd9f016c"
},
{
"url": "https://git.kernel.org/stable/c/4e0ed44e51727d56244a822ab941efe507c47966"
},
{
"url": "https://git.kernel.org/stable/c/e3f95b1ba242e37093305812df7fdbe7288a43ac"
},
{
"url": "https://git.kernel.org/stable/c/0aacb6d18f76552e3e0ee25d9f40d21b3486f4cf"
},
{
"url": "https://git.kernel.org/stable/c/69a7cfc66405aeaa2483147653d031b3592ffc9c"
},
{
"url": "https://git.kernel.org/stable/c/0304d60abb9dcc02bc7fe6d1850f4ca206e8f1a0"
},
{
"url": "https://git.kernel.org/stable/c/bc7304f3ae20972d11db6e0b1b541c63feda5f05"
}
],
"title": "futex: Prevent lockup in requeue-PI during signal/ timeout wakeup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52977",
"datePublished": "2026-06-24T16:28:53.937Z",
"dateReserved": "2026-06-09T07:44:35.376Z",
"dateUpdated": "2026-08-19T16:28:04.076Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53071 (GCVE-0-2026-53071)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding
l2cap_chan_lock(). Every other l2cap_chan_del() caller in the file
acquires the lock first. A remote BLE device can send a crafted
L2CAP ECRED reconfiguration response to corrupt the channel list
while another thread is iterating it.
Add l2cap_chan_hold() and l2cap_chan_lock() before l2cap_chan_del(),
and l2cap_chan_unlock() and l2cap_chan_put() after, matching the
pattern used in l2cap_ecred_conn_rsp() and l2cap_conn_del().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.37.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.146.1.rt7.487.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.146.1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.29.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s Bluetooth Logical Link Control and Adaptation Protocol (L2CAP) implementation. A remote Bluetooth Low Energy (BLE) device can exploit this by sending a specially crafted L2CAP ECRED reconfiguration response. This can lead to the corruption of the channel list, potentially causing a Denial of Service (DoS) by making the system unstable or unresponsive. The vulnerability is due to a missing channel lock when a channel is deleted."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T12:08:03.785Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-53071"
},
{
"name": "RHBZ#2492458",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492458"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53071.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42919"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:43307"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42552"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42550"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:42919: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:43307: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:42552: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:42550: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "96dca51715d86559ed6ed8028e5445cecb80f3ae",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "330b20ec97916961ee0e6c29c06bc0fa7c96e64c",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "0ccd75c51f620374086f359e906917676e699a1c",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "77a853aec710b2fdf41fa298ea3cbc9a4358f917",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "fe1188abdae9b7a8199dcdfcf9244d5e5d61eb14",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "dc89961b76f12aff47124c1df4bdb32a080f4d0c",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "5501d055a1ce3c747141e3955ba8cf034d193f3e",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "42776497cdbc9a665b384a6dcb85f0d4bd927eab",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp\n\nl2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding\nl2cap_chan_lock(). Every other l2cap_chan_del() caller in the file\nacquires the lock first. A remote BLE device can send a crafted\nL2CAP ECRED reconfiguration response to corrupt the channel list\nwhile another thread is iterating it.\n\nAdd l2cap_chan_hold() and l2cap_chan_lock() before l2cap_chan_del(),\nand l2cap_chan_unlock() and l2cap_chan_put() after, matching the\npattern used in l2cap_ecred_conn_rsp() and l2cap_conn_del()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - Bluetooth L2CAP LE signaling is reachable over a nearby Bluetooth Low Energy link from a remote BLE peer. This requires adjacent radio proximity rather than IP network access.\nAC:L - The vulnerable path is triggered by a crafted ECRED reconfiguration response after an ECRED channel/reconfiguration exists, and ECRED is enabled by default. The race is between attacker-timed peer signaling and normal channel/socket activity, with no rare external condition required.\nPR:N - The receive path performs no OS privilege or capability check on the remote peer before dispatching the L2CAP_ECRED_RECONF_RSP. A nearby BLE device can send the crafted response as protocol input without local credentials.\nUI:N - In a plausible phone, embedded, or IoT deployment, an ECRED-using service can maintain/reconfigure BLE channels without a victim performing an exploit-time action. The attacker only needs to send the malicious BLE response at the protocol level.\nS:U - The corruption occurs inside the kernel Bluetooth/L2CAP subsystem and impacts the same kernel security authority. It is not a VM escape or other cross-scope boundary bypass.\nC:H - The missing channel lock permits unsynchronized channel deletion and list/lifetime corruption in kernel memory. As memory corruption, it is defensible to treat it as capable of yielding kernel information disclosure primitives.\nI:H - Concurrent `l2cap_chan_del()` without the required channel lock can corrupt kernel list/object state and potentially be shaped beyond a simple disconnect. Under the required conservative scoring rule, this kernel memory corruption supports high integrity impact.\nA:H - At minimum, corrupted L2CAP channel list/lifetime state can cause kernel oops, panic, or hang. The vulnerable code can be reached repeatedly by a malicious nearby BLE peer."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:05.835Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/96dca51715d86559ed6ed8028e5445cecb80f3ae"
},
{
"url": "https://git.kernel.org/stable/c/330b20ec97916961ee0e6c29c06bc0fa7c96e64c"
},
{
"url": "https://git.kernel.org/stable/c/0ccd75c51f620374086f359e906917676e699a1c"
},
{
"url": "https://git.kernel.org/stable/c/77a853aec710b2fdf41fa298ea3cbc9a4358f917"
},
{
"url": "https://git.kernel.org/stable/c/fe1188abdae9b7a8199dcdfcf9244d5e5d61eb14"
},
{
"url": "https://git.kernel.org/stable/c/dc89961b76f12aff47124c1df4bdb32a080f4d0c"
},
{
"url": "https://git.kernel.org/stable/c/5501d055a1ce3c747141e3955ba8cf034d193f3e"
},
{
"url": "https://git.kernel.org/stable/c/42776497cdbc9a665b384a6dcb85f0d4bd927eab"
}
],
"title": "Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53071",
"datePublished": "2026-06-24T16:30:12.694Z",
"dateReserved": "2026-06-09T07:44:35.382Z",
"dateUpdated": "2026-08-05T12:33:05.835Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52993 (GCVE-0-2026-52993)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix double-free in tipc_buf_append()
tipc_msg_validate() can potentially reallocate the skb it is validating,
freeing the old one. In tipc_buf_append(), it was being called with a
pointer to a local variable which was a copy of the caller's skb
pointer.
If the skb was reallocated and validation subsequently failed, the error
handling path would free the original skb pointer, which had already
been freed, leading to double-free.
Fix this by checking if head now points to a newly allocated reassembled
skb. If it does, reassign *headbuf for later freeing operations.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d618d09a68e4eed7a435beb2e355250f6f40664a Version: d618d09a68e4eed7a435beb2e355250f6f40664a Version: d618d09a68e4eed7a435beb2e355250f6f40664a Version: d618d09a68e4eed7a435beb2e355250f6f40664a Version: d618d09a68e4eed7a435beb2e355250f6f40664a Version: d618d09a68e4eed7a435beb2e355250f6f40664a Version: d618d09a68e4eed7a435beb2e355250f6f40664a Version: d618d09a68e4eed7a435beb2e355250f6f40664a |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.40.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.147.1.rt7.488.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.147.1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.33.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s Transparent Inter-Process Communication (TIPC) module. This vulnerability, a double-free, occurs when the `tipc_buf_append()` function incorrectly handles memory after a socket buffer (skb) reallocation. An attacker could potentially exploit this to cause system instability or a denial of service. In some scenarios, this type of memory corruption could also lead to arbitrary code execution."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-763",
"description": "Release of Invalid Pointer or Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T12:05:48.382Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-52993"
},
{
"name": "RHBZ#2492437",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492437"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52993.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47017"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:49212"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:45115"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:45116"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:47017: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:49212: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:45115: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:45116: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: tipc: fix double-free in tipc_buf_append()",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/tipc/msg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a438975a6dcdbd70865978c021650d1485586f0b",
"status": "affected",
"version": "d618d09a68e4eed7a435beb2e355250f6f40664a",
"versionType": "git"
},
{
"lessThan": "4ee4deadaae7cb2e3d53af0fc889cf92a73413c0",
"status": "affected",
"version": "d618d09a68e4eed7a435beb2e355250f6f40664a",
"versionType": "git"
},
{
"lessThan": "d3556656c6daebf8def751c7e71d11dd0a180d24",
"status": "affected",
"version": "d618d09a68e4eed7a435beb2e355250f6f40664a",
"versionType": "git"
},
{
"lessThan": "0274f24485fc38032d4093e463dc3ff5c7a667c9",
"status": "affected",
"version": "d618d09a68e4eed7a435beb2e355250f6f40664a",
"versionType": "git"
},
{
"lessThan": "4d104882bc815d4ec666ace9155f5f52715879a6",
"status": "affected",
"version": "d618d09a68e4eed7a435beb2e355250f6f40664a",
"versionType": "git"
},
{
"lessThan": "1d5e589055880fae229e229e1929e087dbe08cf3",
"status": "affected",
"version": "d618d09a68e4eed7a435beb2e355250f6f40664a",
"versionType": "git"
},
{
"lessThan": "29940fff14110ca48c5ccc168d121665b51bb778",
"status": "affected",
"version": "d618d09a68e4eed7a435beb2e355250f6f40664a",
"versionType": "git"
},
{
"lessThan": "d293ca716e7d5dffdaecaf6b9b2f857a33dc3d3a",
"status": "affected",
"version": "d618d09a68e4eed7a435beb2e355250f6f40664a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/tipc/msg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix double-free in tipc_buf_append()\n\ntipc_msg_validate() can potentially reallocate the skb it is validating,\nfreeing the old one. In tipc_buf_append(), it was being called with a\npointer to a local variable which was a copy of the caller\u0027s skb\npointer.\n\nIf the skb was reallocated and validation subsequently failed, the error\nhandling path would free the original skb pointer, which had already\nbeen freed, leading to double-free.\n\nFix this by checking if head now points to a newly allocated reassembled\nskb. If it does, reassign *headbuf for later freeing operations."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - TIPC fragment reassembly is reachable from off-node packets via configured TIPC bearers, including the UDP media path over IP. The most severe reasonable deployment is a TIPC UDP cluster service reachable over a network.\nAC:L - A malicious TIPC peer can craft the fragment sequence to inflate the reassembled skb truesize and make the copied inner message fail validation. No attacker-uncontrolled race or rare condition is required.\nPR:N - No target credentials or local account are required to send TIPC packets to an exposed bearer and establish/use the link path. The checks are TIPC discovery/link state checks, not user authentication.\nUI:N - Exploitation is packet-driven and does not require a victim user to open a file, mount anything, or take any other action.\nS:U - The bug corrupts kernel networking memory within the same kernel security authority. It does not cross a separate scope such as guest-to-host or an IOMMU boundary.\nC:H - The double-free of an skb is kernel heap memory corruption and can be leveraged as a use-after-free primitive. Conservatively, this supports high confidentiality impact.\nI:H - The double-free/use-after-free condition can be shaped into kernel memory corruption and potential control-flow or data modification primitives. Conservatively, this supports high integrity impact.\nA:H - Even without full exploitation, double-free of a kernel skb can trigger kernel heap corruption, oops, panic, or networking stack crash. This is high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:27.877Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a438975a6dcdbd70865978c021650d1485586f0b"
},
{
"url": "https://git.kernel.org/stable/c/4ee4deadaae7cb2e3d53af0fc889cf92a73413c0"
},
{
"url": "https://git.kernel.org/stable/c/d3556656c6daebf8def751c7e71d11dd0a180d24"
},
{
"url": "https://git.kernel.org/stable/c/0274f24485fc38032d4093e463dc3ff5c7a667c9"
},
{
"url": "https://git.kernel.org/stable/c/4d104882bc815d4ec666ace9155f5f52715879a6"
},
{
"url": "https://git.kernel.org/stable/c/1d5e589055880fae229e229e1929e087dbe08cf3"
},
{
"url": "https://git.kernel.org/stable/c/29940fff14110ca48c5ccc168d121665b51bb778"
},
{
"url": "https://git.kernel.org/stable/c/d293ca716e7d5dffdaecaf6b9b2f857a33dc3d3a"
}
],
"title": "tipc: fix double-free in tipc_buf_append()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52993",
"datePublished": "2026-06-24T16:29:06.475Z",
"dateReserved": "2026-06-09T07:44:35.377Z",
"dateUpdated": "2026-08-05T12:32:27.877Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53088 (GCVE-0-2026-53088)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: bcmgenet: fix off-by-one in bcmgenet_put_txcb
The write_ptr points to the next open tx_cb. We want to return the
tx_cb that gets rewinded, so we must rewind the pointer first then
return the tx_cb that it points to. That way the txcb can be correctly
cleaned up.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 876dbadd53a7102e2a84afc84ea2bd3ee6dc5636 Version: 876dbadd53a7102e2a84afc84ea2bd3ee6dc5636 Version: 876dbadd53a7102e2a84afc84ea2bd3ee6dc5636 Version: 876dbadd53a7102e2a84afc84ea2bd3ee6dc5636 Version: 876dbadd53a7102e2a84afc84ea2bd3ee6dc5636 Version: 876dbadd53a7102e2a84afc84ea2bd3ee6dc5636 Version: 876dbadd53a7102e2a84afc84ea2bd3ee6dc5636 Version: 876dbadd53a7102e2a84afc84ea2bd3ee6dc5636 Version: 3bdf77194ea822390b405639b77659071fd2c2e9 Version: 3.16.50 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/genet/bcmgenet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "14e9f86564fff7bcf7f45c1b69080e837b31d185",
"status": "affected",
"version": "876dbadd53a7102e2a84afc84ea2bd3ee6dc5636",
"versionType": "git"
},
{
"lessThan": "fb9a3c1f547d0ff024dbfe7b6f327626ddf0a3de",
"status": "affected",
"version": "876dbadd53a7102e2a84afc84ea2bd3ee6dc5636",
"versionType": "git"
},
{
"lessThan": "85f34ec320d3881badfd4edc5fee5cd5012bb54d",
"status": "affected",
"version": "876dbadd53a7102e2a84afc84ea2bd3ee6dc5636",
"versionType": "git"
},
{
"lessThan": "2a74590170427a3ca7cc4bb8690cdd559129c29c",
"status": "affected",
"version": "876dbadd53a7102e2a84afc84ea2bd3ee6dc5636",
"versionType": "git"
},
{
"lessThan": "29394f722f620281f2ee9a47f947734e53d72c90",
"status": "affected",
"version": "876dbadd53a7102e2a84afc84ea2bd3ee6dc5636",
"versionType": "git"
},
{
"lessThan": "4cab761fc51c65aef741fcece4a18f3554edbc09",
"status": "affected",
"version": "876dbadd53a7102e2a84afc84ea2bd3ee6dc5636",
"versionType": "git"
},
{
"lessThan": "72df896e31ddd06fcc5a789f025ad7a62a18bc9b",
"status": "affected",
"version": "876dbadd53a7102e2a84afc84ea2bd3ee6dc5636",
"versionType": "git"
},
{
"lessThan": "57f3f53d2c9c5a9e133596e2f7bc1c50688a6d38",
"status": "affected",
"version": "876dbadd53a7102e2a84afc84ea2bd3ee6dc5636",
"versionType": "git"
},
{
"status": "affected",
"version": "3bdf77194ea822390b405639b77659071fd2c2e9",
"versionType": "git"
},
{
"lessThan": "3.17",
"status": "affected",
"version": "3.16.50",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/genet/bcmgenet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.13"
},
{
"lessThan": "4.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.16.50",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmgenet: fix off-by-one in bcmgenet_put_txcb\n\nThe write_ptr points to the next open tx_cb. We want to return the\ntx_cb that gets rewinded, so we must rewind the pointer first then\nreturn the tx_cb that it points to. That way the txcb can be correctly\ncleaned up."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable path is the bcmgenet Ethernet transmit path, reachable when a network-facing embedded/router system sends replies or forwards attacker-supplied traffic through the affected interface.\nAC:L - The off-by-one cleanup is deterministic once the transmit error/reclaim path is reached, and an attacker can repeatedly drive transmit activity and resource pressure without needing to win an uncontrolled race.\nPR:N - No authentication or local account is required in the highest-impact network-facing deployment, because unauthenticated network traffic can cause packets to be transmitted through the driver.\nUI:N - Exploitation does not require a victim user to open a file, mount media, or perform any other interactive action.\nS:U - The impact remains within the kernel and the affected host\u0027s networking/DMA resources, without crossing a separate security authority such as a VM boundary.\nC:H - The wrong transmit control block can leave stale skb/DMA metadata and later operate on dangling kernel objects, making kernel memory disclosure a defensible worst-case outcome.\nI:H - The stale control-block cleanup can plausibly become double-free or use-after-free style kernel heap corruption, which is treated as high integrity impact.\nA:H - Even without full exploitation, incorrect cleanup of transmit control blocks and DMA mappings can corrupt driver state, leak resources, or crash/hang networking/kernel execution."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:16.590Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/14e9f86564fff7bcf7f45c1b69080e837b31d185"
},
{
"url": "https://git.kernel.org/stable/c/fb9a3c1f547d0ff024dbfe7b6f327626ddf0a3de"
},
{
"url": "https://git.kernel.org/stable/c/85f34ec320d3881badfd4edc5fee5cd5012bb54d"
},
{
"url": "https://git.kernel.org/stable/c/2a74590170427a3ca7cc4bb8690cdd559129c29c"
},
{
"url": "https://git.kernel.org/stable/c/29394f722f620281f2ee9a47f947734e53d72c90"
},
{
"url": "https://git.kernel.org/stable/c/4cab761fc51c65aef741fcece4a18f3554edbc09"
},
{
"url": "https://git.kernel.org/stable/c/72df896e31ddd06fcc5a789f025ad7a62a18bc9b"
},
{
"url": "https://git.kernel.org/stable/c/57f3f53d2c9c5a9e133596e2f7bc1c50688a6d38"
}
],
"title": "net: bcmgenet: fix off-by-one in bcmgenet_put_txcb",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53088",
"datePublished": "2026-06-24T16:30:27.655Z",
"dateReserved": "2026-06-09T07:44:35.384Z",
"dateUpdated": "2026-08-05T12:33:16.590Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53056 (GCVE-0-2026-53056)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-06-24 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/msm/dpu: fix mismatch between power and frequency
During DPU runtime suspend, calling dev_pm_opp_set_rate(dev, 0) drops
the MMCX rail to MIN_SVS while the core clock frequency remains at its
original (highest) rate. When runtime resume re-enables the clock, this
may result in a mismatch between the rail voltage and the clock rate.
For example, in the DPU bind path, the sequence could be:
cpu0: dev_sync_state -> rpmhpd_sync_state
cpu1: dpu_kms_hw_init
timeline 0 ------------------------------------------------> t
After rpmhpd_sync_state, the voltage performance is no longer guaranteed
to stay at the highest level. During dpu_kms_hw_init, calling
dev_pm_opp_set_rate(dev, 0) drops the voltage, causing the MMCX rail to
fall to MIN_SVS while the core clock is still at its maximum frequency.
When the power is re-enabled, only the clock is enabled, leading to a
situation where the MMCX rail is at MIN_SVS but the core clock is at its
highest rate. In this state, the rail cannot sustain the clock rate,
which may cause instability or system crash.
Remove the call to dev_pm_opp_set_rate(dev, 0) from dpu_runtime_suspend
to ensure the correct vote is restored when DPU resumes.
Patchwork: https://patchwork.freedesktop.org/patch/710077/
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b0530eb1191307e9038d75e5c83973a396137681 Version: b0530eb1191307e9038d75e5c83973a396137681 Version: b0530eb1191307e9038d75e5c83973a396137681 Version: b0530eb1191307e9038d75e5c83973a396137681 Version: b0530eb1191307e9038d75e5c83973a396137681 Version: b0530eb1191307e9038d75e5c83973a396137681 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1181a7028d37e0b1e720a36125a03f5db97e3d27",
"status": "affected",
"version": "b0530eb1191307e9038d75e5c83973a396137681",
"versionType": "git"
},
{
"lessThan": "9830999c9e065c1813ec5435bfe4eab98ee54a87",
"status": "affected",
"version": "b0530eb1191307e9038d75e5c83973a396137681",
"versionType": "git"
},
{
"lessThan": "c5735c7d0eef7a5240f9c1c66e44ba52a1be58d6",
"status": "affected",
"version": "b0530eb1191307e9038d75e5c83973a396137681",
"versionType": "git"
},
{
"lessThan": "0f7dd5839cfabaf9c007fb718ec66e907a473c93",
"status": "affected",
"version": "b0530eb1191307e9038d75e5c83973a396137681",
"versionType": "git"
},
{
"lessThan": "0ccf4f27b4652570b5de3de02a89a86435559de9",
"status": "affected",
"version": "b0530eb1191307e9038d75e5c83973a396137681",
"versionType": "git"
},
{
"lessThan": "bc1dccc518cc5ab5140fba06c27e7188e0ed342b",
"status": "affected",
"version": "b0530eb1191307e9038d75e5c83973a396137681",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"lessThan": "5.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/dpu: fix mismatch between power and frequency\n\nDuring DPU runtime suspend, calling dev_pm_opp_set_rate(dev, 0) drops\nthe MMCX rail to MIN_SVS while the core clock frequency remains at its\noriginal (highest) rate. When runtime resume re-enables the clock, this\nmay result in a mismatch between the rail voltage and the clock rate.\n\nFor example, in the DPU bind path, the sequence could be:\n cpu0: dev_sync_state -\u003e rpmhpd_sync_state\n cpu1: dpu_kms_hw_init\ntimeline 0 ------------------------------------------------\u003e t\n\nAfter rpmhpd_sync_state, the voltage performance is no longer guaranteed\nto stay at the highest level. During dpu_kms_hw_init, calling\ndev_pm_opp_set_rate(dev, 0) drops the voltage, causing the MMCX rail to\nfall to MIN_SVS while the core clock is still at its maximum frequency.\nWhen the power is re-enabled, only the clock is enabled, leading to a\nsituation where the MMCX rail is at MIN_SVS but the core clock is at its\nhighest rate. In this state, the rail cannot sustain the clock rate,\nwhich may cause instability or system crash.\n\nRemove the call to dev_pm_opp_set_rate(dev, 0) from dpu_runtime_suspend\nto ensure the correct vote is restored when DPU resumes.\n\nPatchwork: https://patchwork.freedesktop.org/patch/710077/"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:01.694Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1181a7028d37e0b1e720a36125a03f5db97e3d27"
},
{
"url": "https://git.kernel.org/stable/c/9830999c9e065c1813ec5435bfe4eab98ee54a87"
},
{
"url": "https://git.kernel.org/stable/c/c5735c7d0eef7a5240f9c1c66e44ba52a1be58d6"
},
{
"url": "https://git.kernel.org/stable/c/0f7dd5839cfabaf9c007fb718ec66e907a473c93"
},
{
"url": "https://git.kernel.org/stable/c/0ccf4f27b4652570b5de3de02a89a86435559de9"
},
{
"url": "https://git.kernel.org/stable/c/bc1dccc518cc5ab5140fba06c27e7188e0ed342b"
}
],
"title": "drm/msm/dpu: fix mismatch between power and frequency",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53056",
"datePublished": "2026-06-24T16:30:01.694Z",
"dateReserved": "2026-06-09T07:44:35.381Z",
"dateUpdated": "2026-06-24T16:30:01.694Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53013 (GCVE-0-2026-53013)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-06-24 16:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF
macvlan_get_size() does not account for IFLA_MACVLAN_BC_CUTOFF, but
macvlan_fill_info() conditionally includes it when port->bc_cutoff != 1.
This causes nla_put_s32() to fail with -EMSGSIZE when the netlink skb
runs out of space, triggering a WARN_ON in rtnetlink and preventing the
interface from being dumped.
The bug can be reproduced with:
ip link add macvlan0 link eth0 type macvlan mode bridge
ip link set macvlan0 type macvlan bc_cutoff 0
ip -d link show macvlan0 # fails with -EMSGSIZE
The bc_cutoff feature was added in commit 954d1fa1ac93 ("macvlan: Add
netlink attribute for broadcast cutoff"), which added the nla_put_s32()
call in macvlan_fill_info() but missed adding the corresponding
nla_total_size(4) in macvlan_get_size(). A follow-up commit
55cef78c244d ("macvlan: add forgotten nla_policy for
IFLA_MACVLAN_BC_CUTOFF") fixed the missing nla_policy entry but still
did not fix the size calculation.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/macvlan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4979252758387b338ca968ba7e0515b0ae2257e3",
"status": "affected",
"version": "954d1fa1ac93aa8a66f7d9a9ba545cf7f020d348",
"versionType": "git"
},
{
"lessThan": "77ecfa4e27f282d224215895ddfbeb916fc75e24",
"status": "affected",
"version": "954d1fa1ac93aa8a66f7d9a9ba545cf7f020d348",
"versionType": "git"
},
{
"lessThan": "b6b7154e9f5d75b608ceb2d05b376de8c638c40e",
"status": "affected",
"version": "954d1fa1ac93aa8a66f7d9a9ba545cf7f020d348",
"versionType": "git"
},
{
"lessThan": "1c004f14ccdc11585625c168bb9a7c5e1b8afb0c",
"status": "affected",
"version": "954d1fa1ac93aa8a66f7d9a9ba545cf7f020d348",
"versionType": "git"
},
{
"lessThan": "fa92a77b0ed4d5f11a71665a232ac5a54a4b055d",
"status": "affected",
"version": "954d1fa1ac93aa8a66f7d9a9ba545cf7f020d348",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/macvlan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmacvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF\n\nmacvlan_get_size() does not account for IFLA_MACVLAN_BC_CUTOFF, but\nmacvlan_fill_info() conditionally includes it when port-\u003ebc_cutoff != 1.\nThis causes nla_put_s32() to fail with -EMSGSIZE when the netlink skb\nruns out of space, triggering a WARN_ON in rtnetlink and preventing the\ninterface from being dumped.\n\nThe bug can be reproduced with:\n\n ip link add macvlan0 link eth0 type macvlan mode bridge\n ip link set macvlan0 type macvlan bc_cutoff 0\n ip -d link show macvlan0 # fails with -EMSGSIZE\n\nThe bc_cutoff feature was added in commit 954d1fa1ac93 (\"macvlan: Add\nnetlink attribute for broadcast cutoff\"), which added the nla_put_s32()\ncall in macvlan_fill_info() but missed adding the corresponding\nnla_total_size(4) in macvlan_get_size(). A follow-up commit\n55cef78c244d (\"macvlan: add forgotten nla_policy for\nIFLA_MACVLAN_BC_CUTOFF\") fixed the missing nla_policy entry but still\ndid not fix the size calculation."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:29:23.856Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4979252758387b338ca968ba7e0515b0ae2257e3"
},
{
"url": "https://git.kernel.org/stable/c/77ecfa4e27f282d224215895ddfbeb916fc75e24"
},
{
"url": "https://git.kernel.org/stable/c/b6b7154e9f5d75b608ceb2d05b376de8c638c40e"
},
{
"url": "https://git.kernel.org/stable/c/1c004f14ccdc11585625c168bb9a7c5e1b8afb0c"
},
{
"url": "https://git.kernel.org/stable/c/fa92a77b0ed4d5f11a71665a232ac5a54a4b055d"
}
],
"title": "macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53013",
"datePublished": "2026-06-24T16:29:23.856Z",
"dateReserved": "2026-06-09T07:44:35.378Z",
"dateUpdated": "2026-06-24T16:29:23.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52936 (GCVE-0-2026-52936)
Vulnerability from cvelistv5
Published
2026-06-24 07:14
Modified
2026-06-24 07:14
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: jitterentropy - replace long-held spinlock with mutex
jent_kcapi_random() serializes the shared jitterentropy state, but it
currently holds a spinlock across the jent_read_entropy() call. That
path performs expensive jitter collection and SHA3 conditioning, so
parallel readers can trigger stalls as contending waiters spin for
the same lock.
To prevent non-preemptible lock hold, replace rng->jent_lock with a
mutex so contended readers sleep instead of spinning on a shared lock
held across expensive entropy generation.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"crypto/jitterentropy-kcapi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "18216b8ab6904753eaf31baf453cb02ecd202ba4",
"status": "affected",
"version": "bb5530e4082446aac3a3d69780cd4dbfa4520013",
"versionType": "git"
},
{
"lessThan": "4c03e6eb98443dc4d6d422a9780034a5b75376b4",
"status": "affected",
"version": "bb5530e4082446aac3a3d69780cd4dbfa4520013",
"versionType": "git"
},
{
"lessThan": "ff734dbd9e2432601a6dcd167cfb0bf8a36d1880",
"status": "affected",
"version": "bb5530e4082446aac3a3d69780cd4dbfa4520013",
"versionType": "git"
},
{
"lessThan": "ec427dc5286da1ed08f2d510e2147a7581b0cb02",
"status": "affected",
"version": "bb5530e4082446aac3a3d69780cd4dbfa4520013",
"versionType": "git"
},
{
"lessThan": "01d798e9feb30212952d4e992801ba6bd6a82351",
"status": "affected",
"version": "bb5530e4082446aac3a3d69780cd4dbfa4520013",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"crypto/jitterentropy-kcapi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: jitterentropy - replace long-held spinlock with mutex\n\njent_kcapi_random() serializes the shared jitterentropy state, but it\ncurrently holds a spinlock across the jent_read_entropy() call. That\npath performs expensive jitter collection and SHA3 conditioning, so\nparallel readers can trigger stalls as contending waiters spin for\nthe same lock.\n\nTo prevent non-preemptible lock hold, replace rng-\u003ejent_lock with a\nmutex so contended readers sleep instead of spinning on a shared lock\nheld across expensive entropy generation."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T07:14:26.649Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/18216b8ab6904753eaf31baf453cb02ecd202ba4"
},
{
"url": "https://git.kernel.org/stable/c/4c03e6eb98443dc4d6d422a9780034a5b75376b4"
},
{
"url": "https://git.kernel.org/stable/c/ff734dbd9e2432601a6dcd167cfb0bf8a36d1880"
},
{
"url": "https://git.kernel.org/stable/c/ec427dc5286da1ed08f2d510e2147a7581b0cb02"
},
{
"url": "https://git.kernel.org/stable/c/01d798e9feb30212952d4e992801ba6bd6a82351"
}
],
"title": "crypto: jitterentropy - replace long-held spinlock with mutex",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52936",
"datePublished": "2026-06-24T07:14:26.649Z",
"dateReserved": "2026-06-09T07:44:35.370Z",
"dateUpdated": "2026-06-24T07:14:26.649Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52910 (GCVE-0-2026-52910)
Vulnerability from cvelistv5
Published
2026-06-19 14:43
Modified
2026-08-05 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Free reuseport cBPF prog after RCU grace period.
Eulgyu Kim reported the splat below with a repro. [0]
The repro sets up a UDP reuseport group with a cBPF prog and
replaces it with a new one while another thread is sending
a UDP packet to the group.
The reuseport prog is freed by sk_reuseport_prog_free().
bpf_prog_put() is called for "e"BPF prog to destruct through
multiple stages while cBPF prog is freed immediately by
bpf_release_orig_filter() and bpf_prog_free().
If a reuseport prog is detached from the setsockopt() path
(reuseport_attach_prog() or reuseport_detach_prog()),
sk_reuseport_prog_free() is called without waiting for RCU
readers to complete, resulting in various bugs.
Let's defer freeing the reuseport cBPF prog after one RCU
grace period.
Note "e"BPF prog is safe as is unless the fast path starts
to touch fields destroyed in bpf_prog_put_deferred() and
__bpf_prog_put_noref().
[0]:
BUG: KASAN: vmalloc-out-of-bounds in reuseport_select_sock+0xedc/0x1220 net/core/sock_reuseport.c:596
Read of size 4 at addr ffffc9000051e004 by task slowme/10208
CPU: 6 UID: 1000 PID: 10208 Comm: slowme Not tainted 7.0.0-geb7ac95ff75e #32 PREEMPT(full)
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<IRQ>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x240 mm/kasan/report.c:482
kasan_report+0x118/0x150 mm/kasan/report.c:595
reuseport_select_sock+0xedc/0x1220 net/core/sock_reuseport.c:596
udp4_lib_lookup2+0x3bc/0x950 net/ipv4/udp.c:495
__udp4_lib_lookup+0x768/0xe20 net/ipv4/udp.c:723
__udp4_lib_lookup_skb+0x297/0x390 net/ipv4/udp.c:752
__udp4_lib_rcv+0x1312/0x2620 net/ipv4/udp.c:2752
ip_protocol_deliver_rcu+0x282/0x440 net/ipv4/ip_input.c:207
ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:241
NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318
NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318
__netif_receive_skb_one_core net/core/dev.c:6181 [inline]
__netif_receive_skb net/core/dev.c:6294 [inline]
process_backlog+0xaa4/0x1960 net/core/dev.c:6645
__napi_poll+0xae/0x340 net/core/dev.c:7709
napi_poll net/core/dev.c:7772 [inline]
net_rx_action+0x5d7/0xf50 net/core/dev.c:7929
handle_softirqs+0x22b/0x870 kernel/softirq.c:622
do_softirq+0x76/0xd0 kernel/softirq.c:523
</IRQ>
<TASK>
__local_bh_enable_ip+0xf8/0x130 kernel/softirq.c:450
local_bh_enable include/linux/bottom_half.h:33 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:924 [inline]
__dev_queue_xmit+0x1dd7/0x3710 net/core/dev.c:4890
neigh_output include/net/neighbour.h:556 [inline]
ip_finish_output2+0xca9/0x1070 net/ipv4/ip_output.c:237
NF_HOOK_COND include/linux/netfilter.h:307 [inline]
ip_output+0x29f/0x450 net/ipv4/ip_output.c:438
ip_send_skb+0x45/0xc0 net/ipv4/ip_output.c:1508
udp_send_skb+0xb04/0x1510 net/ipv4/udp.c:1195
udp_sendmsg+0x1a71/0x2350 net/ipv4/udp.c:1485
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
__sys_sendto+0x554/0x680 net/socket.c:2206
__do_sys_sendto net/socket.c:2213 [inline]
__se_sys_sendto net/socket.c:2209 [inline]
__x64_sys_sendto+0xde/0x100 net/socket.c:2209
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x160/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x415a2d
Code: b3 66 2e 0f 1f 84 00 00 00 00 00 66 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6bc31e41e8 EFLAGS: 00000212 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f6bc31e4cdc RCX: 0000000000415a2d
RDX: 0000000000000001 RSI: 00007f6bc31e421f RDI: 0000000000000003
RBP: 00007f6bc31e4240 R08: 00007f6bc31e4220 R09: 0000000000000010
R10: 0000000000000000 R11:
---truncated---
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 538950a1b7527a0a52ccd9337e3fcd304f027f13 Version: 538950a1b7527a0a52ccd9337e3fcd304f027f13 Version: 538950a1b7527a0a52ccd9337e3fcd304f027f13 Version: 538950a1b7527a0a52ccd9337e3fcd304f027f13 Version: 538950a1b7527a0a52ccd9337e3fcd304f027f13 Version: 538950a1b7527a0a52ccd9337e3fcd304f027f13 Version: 538950a1b7527a0a52ccd9337e3fcd304f027f13 Version: 538950a1b7527a0a52ccd9337e3fcd304f027f13 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unknown",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s Berkeley Packet Filter (BPF) reuseport mechanism. When a cBPF program is detached from a reuseport group, it is freed immediately without waiting for Read-Copy-Update (RCU) readers to complete. This can lead to a use-after-free condition, resulting in memory corruption (specifically, an out-of-bounds read) if another thread is simultaneously sending UDP packets to the reuseport group. This vulnerability can cause system instability and various other bugs."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-364",
"description": "Signal Handler Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T02:48:22.880Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-52910"
},
{
"name": "RHBZ#2490779",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490779"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52910.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-19T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-19T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: bpf: Free reuseport cBPF prog after RCU grace period",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "08264d5bba0bdd3a79bc2984fee09286aba0c4eb",
"status": "affected",
"version": "538950a1b7527a0a52ccd9337e3fcd304f027f13",
"versionType": "git"
},
{
"lessThan": "fec41484e7c2aa7ded44c541bba98872be937754",
"status": "affected",
"version": "538950a1b7527a0a52ccd9337e3fcd304f027f13",
"versionType": "git"
},
{
"lessThan": "c3e3fddda6b5d9ba505d218b4055e7d8a282ac57",
"status": "affected",
"version": "538950a1b7527a0a52ccd9337e3fcd304f027f13",
"versionType": "git"
},
{
"lessThan": "f8b8f1d4bb76098e87b8269a0631019648330e6d",
"status": "affected",
"version": "538950a1b7527a0a52ccd9337e3fcd304f027f13",
"versionType": "git"
},
{
"lessThan": "298db6167f81e9c470a57cf652e4e47757b4293e",
"status": "affected",
"version": "538950a1b7527a0a52ccd9337e3fcd304f027f13",
"versionType": "git"
},
{
"lessThan": "87dfb977bdb6eaa47e9993a34e18f44970f88b1f",
"status": "affected",
"version": "538950a1b7527a0a52ccd9337e3fcd304f027f13",
"versionType": "git"
},
{
"lessThan": "90e47dc5c572d1c73971ac51c7428803f42b78eb",
"status": "affected",
"version": "538950a1b7527a0a52ccd9337e3fcd304f027f13",
"versionType": "git"
},
{
"lessThan": "18fc650ccd7fe3376eca89203668cfb8268f60df",
"status": "affected",
"version": "538950a1b7527a0a52ccd9337e3fcd304f027f13",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.5"
},
{
"lessThan": "4.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Free reuseport cBPF prog after RCU grace period.\n\nEulgyu Kim reported the splat below with a repro. [0]\n\nThe repro sets up a UDP reuseport group with a cBPF prog and\nreplaces it with a new one while another thread is sending\na UDP packet to the group.\n\nThe reuseport prog is freed by sk_reuseport_prog_free().\nbpf_prog_put() is called for \"e\"BPF prog to destruct through\nmultiple stages while cBPF prog is freed immediately by\nbpf_release_orig_filter() and bpf_prog_free().\n\nIf a reuseport prog is detached from the setsockopt() path\n(reuseport_attach_prog() or reuseport_detach_prog()),\nsk_reuseport_prog_free() is called without waiting for RCU\nreaders to complete, resulting in various bugs.\n\nLet\u0027s defer freeing the reuseport cBPF prog after one RCU\ngrace period.\n\nNote \"e\"BPF prog is safe as is unless the fast path starts\nto touch fields destroyed in bpf_prog_put_deferred() and\n__bpf_prog_put_noref().\n\n[0]:\nBUG: KASAN: vmalloc-out-of-bounds in reuseport_select_sock+0xedc/0x1220 net/core/sock_reuseport.c:596\nRead of size 4 at addr ffffc9000051e004 by task slowme/10208\nCPU: 6 UID: 1000 PID: 10208 Comm: slowme Not tainted 7.0.0-geb7ac95ff75e #32 PREEMPT(full)\nHardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nCall Trace:\n \u003cIRQ\u003e\n dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xca/0x240 mm/kasan/report.c:482\n kasan_report+0x118/0x150 mm/kasan/report.c:595\n reuseport_select_sock+0xedc/0x1220 net/core/sock_reuseport.c:596\n udp4_lib_lookup2+0x3bc/0x950 net/ipv4/udp.c:495\n __udp4_lib_lookup+0x768/0xe20 net/ipv4/udp.c:723\n __udp4_lib_lookup_skb+0x297/0x390 net/ipv4/udp.c:752\n __udp4_lib_rcv+0x1312/0x2620 net/ipv4/udp.c:2752\n ip_protocol_deliver_rcu+0x282/0x440 net/ipv4/ip_input.c:207\n ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:241\n NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318\n NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318\n __netif_receive_skb_one_core net/core/dev.c:6181 [inline]\n __netif_receive_skb net/core/dev.c:6294 [inline]\n process_backlog+0xaa4/0x1960 net/core/dev.c:6645\n __napi_poll+0xae/0x340 net/core/dev.c:7709\n napi_poll net/core/dev.c:7772 [inline]\n net_rx_action+0x5d7/0xf50 net/core/dev.c:7929\n handle_softirqs+0x22b/0x870 kernel/softirq.c:622\n do_softirq+0x76/0xd0 kernel/softirq.c:523\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n __local_bh_enable_ip+0xf8/0x130 kernel/softirq.c:450\n local_bh_enable include/linux/bottom_half.h:33 [inline]\n rcu_read_unlock_bh include/linux/rcupdate.h:924 [inline]\n __dev_queue_xmit+0x1dd7/0x3710 net/core/dev.c:4890\n neigh_output include/net/neighbour.h:556 [inline]\n ip_finish_output2+0xca9/0x1070 net/ipv4/ip_output.c:237\n NF_HOOK_COND include/linux/netfilter.h:307 [inline]\n ip_output+0x29f/0x450 net/ipv4/ip_output.c:438\n ip_send_skb+0x45/0xc0 net/ipv4/ip_output.c:1508\n udp_send_skb+0xb04/0x1510 net/ipv4/udp.c:1195\n udp_sendmsg+0x1a71/0x2350 net/ipv4/udp.c:1485\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg net/socket.c:742 [inline]\n __sys_sendto+0x554/0x680 net/socket.c:2206\n __do_sys_sendto net/socket.c:2213 [inline]\n __se_sys_sendto net/socket.c:2209 [inline]\n __x64_sys_sendto+0xde/0x100 net/socket.c:2209\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x160/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x415a2d\nCode: b3 66 2e 0f 1f 84 00 00 00 00 00 66 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f6bc31e41e8 EFLAGS: 00000212 ORIG_RAX: 000000000000002c\nRAX: ffffffffffffffda RBX: 00007f6bc31e4cdc RCX: 0000000000415a2d\nRDX: 0000000000000001 RSI: 00007f6bc31e421f RDI: 0000000000000003\nRBP: 00007f6bc31e4240 R08: 00007f6bc31e4220 R09: 0000000000000010\nR10: 0000000000000000 R11: \n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable attach/detach operation is reached through local `setsockopt()` on an `SO_REUSEPORT` socket with `SO_ATTACH_REUSEPORT_CBPF` or `SO_DETACH_REUSEPORT_BPF`. Although packet receive executes the stale program, the attacker-controlled trigger for freeing/replacing it is a local socket API path.\nAC:L - The race is attacker-controlled: a local attacker can create the UDP reuseport group, replace/detach the cBPF program, and concurrently send packets to drive `reuseport_select_sock()`. No rare external condition is required.\nPR:L - A basic unprivileged local user can create UDP sockets on an unprivileged port, set `SO_REUSEPORT`, and attach a classic reuseport BPF filter; this path does not require `CAP_NET_ADMIN`. User namespaces are not needed to make the path reachable.\nUI:N - No victim user action is required once the attacker runs the local reproducer. The attacker controls the sockets, the filter replacement, and the packet generation.\nS:U - The bug is a kernel memory lifetime error used for local kernel compromise or crash within the same host security authority. It does not cross a VM, IOMMU, or similar security boundary.\nC:H - This is a use-after-free of a `bpf_prog` object that is dereferenced after reclamation while selecting a reuseport socket. Per kernel CVSS guidance, UAFs are treated as enabling high confidentiality impact through potential kernel memory disclosure.\nI:H - The stale freed `bpf_prog` can be reused while the receive path reads and runs through the program object, making control-flow or data corruption plausible. Per kernel CVSS guidance, UAF memory corruption warrants high integrity impact.\nA:H - The reported reproducer triggers a KASAN vmalloc out-of-bounds/use-after-free splat in the packet receive path. Such kernel memory corruption can reliably crash or destabilize the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:33.683Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/08264d5bba0bdd3a79bc2984fee09286aba0c4eb"
},
{
"url": "https://git.kernel.org/stable/c/fec41484e7c2aa7ded44c541bba98872be937754"
},
{
"url": "https://git.kernel.org/stable/c/c3e3fddda6b5d9ba505d218b4055e7d8a282ac57"
},
{
"url": "https://git.kernel.org/stable/c/f8b8f1d4bb76098e87b8269a0631019648330e6d"
},
{
"url": "https://git.kernel.org/stable/c/298db6167f81e9c470a57cf652e4e47757b4293e"
},
{
"url": "https://git.kernel.org/stable/c/87dfb977bdb6eaa47e9993a34e18f44970f88b1f"
},
{
"url": "https://git.kernel.org/stable/c/90e47dc5c572d1c73971ac51c7428803f42b78eb"
},
{
"url": "https://git.kernel.org/stable/c/18fc650ccd7fe3376eca89203668cfb8268f60df"
}
],
"title": "bpf: Free reuseport cBPF prog after RCU grace period.",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52910",
"datePublished": "2026-06-19T14:43:33.952Z",
"dateReserved": "2026-06-09T07:44:35.366Z",
"dateUpdated": "2026-08-05T12:31:33.683Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52981 (GCVE-0-2026-52981)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
neigh: let neigh_xmit take skb ownership
neigh_xmit always releases the skb, except when no neighbour table is
found. But even the first added user of neigh_xmit (mpls) relied on
neigh_xmit to release the skb (or queue it for tx).
sashiko reported:
If neigh_xmit() is called with an uninitialized neighbor table (for
example, NEIGH_ND_TABLE when IPv6 is disabled), it returns -EAFNOSUPPORT
and bypasses its internal out_kfree_skb error path. Because the return
value of neigh_xmit() is ignored here, does this leak the SKB?
Assume full ownership and remove the last code path that doesn't
xmit or free skb.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4fd3d7d9e868ffbdb0e7a67c5c8e9dfdcd846a62 Version: 4fd3d7d9e868ffbdb0e7a67c5c8e9dfdcd846a62 Version: 4fd3d7d9e868ffbdb0e7a67c5c8e9dfdcd846a62 Version: 4fd3d7d9e868ffbdb0e7a67c5c8e9dfdcd846a62 Version: 4fd3d7d9e868ffbdb0e7a67c5c8e9dfdcd846a62 Version: 4fd3d7d9e868ffbdb0e7a67c5c8e9dfdcd846a62 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/neighbour.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8a89054a1ec0767aec25ed2bbac933da6ba3cf5a",
"status": "affected",
"version": "4fd3d7d9e868ffbdb0e7a67c5c8e9dfdcd846a62",
"versionType": "git"
},
{
"lessThan": "9247d59ca15bf60a57dca08103f055d8a4340877",
"status": "affected",
"version": "4fd3d7d9e868ffbdb0e7a67c5c8e9dfdcd846a62",
"versionType": "git"
},
{
"lessThan": "0084712e0bee204b284510cdb63182fd5a30c2b7",
"status": "affected",
"version": "4fd3d7d9e868ffbdb0e7a67c5c8e9dfdcd846a62",
"versionType": "git"
},
{
"lessThan": "63063ba60d2dc334e34f1e3f9271d7f3f6f30307",
"status": "affected",
"version": "4fd3d7d9e868ffbdb0e7a67c5c8e9dfdcd846a62",
"versionType": "git"
},
{
"lessThan": "445e45a2c3a078316a62d2d331a570cf34ef5079",
"status": "affected",
"version": "4fd3d7d9e868ffbdb0e7a67c5c8e9dfdcd846a62",
"versionType": "git"
},
{
"lessThan": "4438113be604ee67a7bf4f81da6e1cca41332ce4",
"status": "affected",
"version": "4fd3d7d9e868ffbdb0e7a67c5c8e9dfdcd846a62",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/neighbour.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nneigh: let neigh_xmit take skb ownership\n\nneigh_xmit always releases the skb, except when no neighbour table is\nfound. But even the first added user of neigh_xmit (mpls) relied on\nneigh_xmit to release the skb (or queue it for tx).\n\nsashiko reported:\n If neigh_xmit() is called with an uninitialized neighbor table (for\n example, NEIGH_ND_TABLE when IPv6 is disabled), it returns -EAFNOSUPPORT\n and bypasses its internal out_kfree_skb error path. Because the return\n value of neigh_xmit() is ignored here, does this leak the SKB?\n\nAssume full ownership and remove the last code path that doesn\u0027t\nxmit or free skb."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - An unauthenticated packet sender can trigger the vulnerable `neigh_xmit()` path through configured network forwarding paths such as nftables netdev forwarding or MPLS forwarding. In the highest reasonable deployment, this is an exposed router/firewall datapath reachable by network traffic.\nAC:L - The bug is deterministic once the forwarding path uses a real neighbor table whose pointer is NULL, such as `NEIGH_ND_TABLE` when IPv6 neighbor discovery is unavailable. No race or heap shaping is required; repeated matching packets repeatedly leak skbs.\nPR:N - The attacker does not need privileges to send packets into an already configured vulnerable forwarding datapath. Although installing such rules/routes requires administrative network privileges, the packet-triggering attack itself is unauthenticated.\nUI:N - No victim user action is required after the affected forwarding configuration exists. The attacker only sends traffic that reaches the vulnerable path.\nS:U - The impact remains within the kernel/networking security authority of the affected system. There is no VM escape, sandbox boundary crossing, or separate security scope involved.\nC:N - The flaw is an skb memory leak caused by failing to free the packet buffer on the missing-table error path. It does not expose leaked memory contents to the attacker.\nI:N - The bug does not provide a memory corruption or data modification primitive. It only loses ownership of allocated skbs.\nA:H - An attacker can repeatedly trigger the leak with packets, consuming kernel memory and plausibly causing OOM, hangs, packet processing failure, or system-wide denial of service. Kernel memory exhaustion is a high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:19.237Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8a89054a1ec0767aec25ed2bbac933da6ba3cf5a"
},
{
"url": "https://git.kernel.org/stable/c/9247d59ca15bf60a57dca08103f055d8a4340877"
},
{
"url": "https://git.kernel.org/stable/c/0084712e0bee204b284510cdb63182fd5a30c2b7"
},
{
"url": "https://git.kernel.org/stable/c/63063ba60d2dc334e34f1e3f9271d7f3f6f30307"
},
{
"url": "https://git.kernel.org/stable/c/445e45a2c3a078316a62d2d331a570cf34ef5079"
},
{
"url": "https://git.kernel.org/stable/c/4438113be604ee67a7bf4f81da6e1cca41332ce4"
}
],
"title": "neigh: let neigh_xmit take skb ownership",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52981",
"datePublished": "2026-06-24T16:28:57.074Z",
"dateReserved": "2026-06-09T07:44:35.376Z",
"dateUpdated": "2026-08-05T12:32:19.237Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53223 (GCVE-0-2026-53223)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-08-05 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: guard timestamp cmsgs to real error queue skbs
skb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb
from sk_error_queue. That assumption is not true for AF_PACKET sockets:
outgoing packet taps are also delivered to packet sockets with
skb->pkt_type == PACKET_OUTGOING, but their skb->cb is owned by AF_PACKET
instead of struct sock_exterr_skb.
If such an skb is received with timestamping enabled, the generic
timestamp cmsg path can read AF_PACKET control-buffer state as
sock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop
counter overlaps opt_stats. An odd drop count makes the path emit
SCM_TIMESTAMPING_OPT_STATS with skb->len and skb->data. For non-linear
skbs this copies past the linear head and can trigger hardened usercopy or
disclose adjacent heap contents.
Keep skb_is_err_queue() local to net/socket.c, but make it verify that
the PACKET_OUTGOING marker is paired with the sock_rmem_free destructor
installed by sock_queue_err_skb(). AF_PACKET receive skbs use normal
receive ownership and no longer pass as error-queue skbs, while legitimate
sk_error_queue entries keep the PACKET_OUTGOING marker and sock_rmem_free
ownership.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8605330aac5a5785630aec8f64378a54891937cc Version: 8605330aac5a5785630aec8f64378a54891937cc Version: 8605330aac5a5785630aec8f64378a54891937cc Version: 8605330aac5a5785630aec8f64378a54891937cc Version: 8605330aac5a5785630aec8f64378a54891937cc Version: 8605330aac5a5785630aec8f64378a54891937cc Version: 8605330aac5a5785630aec8f64378a54891937cc Version: 8605330aac5a5785630aec8f64378a54891937cc Version: cdaf15b43bd31003220cb080bcbbd57787a2fca9 Version: 4.10.14 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/sock.h",
"net/core/skbuff.c",
"net/socket.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "24a0d548d3a765cd4558224e4f8e06e14cba26e3",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"lessThan": "71ff5cdd5da61d0438e902aa0fd68c28bc901abe",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"lessThan": "ad9a0374ee6d11048e1f74cd5180bad58b9848b4",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"lessThan": "b903e9b5629ec8dd6db92174070045bf81ad7060",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"lessThan": "e0665b2a8e90bb08bd205062c75662b502d31797",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"lessThan": "3dde4fb941fa5649ab809f6cd3e20e0c424a4e31",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"lessThan": "eb51a9ad3ceb01bc6c0fb608dbc856e03ee6f24a",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"lessThan": "1ee90b77b727df903033db873c75caac5c27ec98",
"status": "affected",
"version": "8605330aac5a5785630aec8f64378a54891937cc",
"versionType": "git"
},
{
"status": "affected",
"version": "cdaf15b43bd31003220cb080bcbbd57787a2fca9",
"versionType": "git"
},
{
"lessThan": "4.11",
"status": "affected",
"version": "4.10.14",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/sock.h",
"net/core/skbuff.c",
"net/socket.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.10.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: guard timestamp cmsgs to real error queue skbs\n\nskb_is_err_queue() treats PACKET_OUTGOING as the sole marker for an skb\nfrom sk_error_queue. That assumption is not true for AF_PACKET sockets:\noutgoing packet taps are also delivered to packet sockets with\nskb-\u003epkt_type == PACKET_OUTGOING, but their skb-\u003ecb is owned by AF_PACKET\ninstead of struct sock_exterr_skb.\n\nIf such an skb is received with timestamping enabled, the generic\ntimestamp cmsg path can read AF_PACKET control-buffer state as\nsock_exterr_skb::opt_stats. With SO_RXQ_OVFL enabled, the packet drop\ncounter overlaps opt_stats. An odd drop count makes the path emit\nSCM_TIMESTAMPING_OPT_STATS with skb-\u003elen and skb-\u003edata. For non-linear\nskbs this copies past the linear head and can trigger hardened usercopy or\ndisclose adjacent heap contents.\n\nKeep skb_is_err_queue() local to net/socket.c, but make it verify that\nthe PACKET_OUTGOING marker is paired with the sock_rmem_free destructor\ninstalled by sock_queue_err_skb(). AF_PACKET receive skbs use normal\nreceive ownership and no longer pass as error-queue skbs, while legitimate\nsk_error_queue entries keep the PACKET_OUTGOING marker and sock_rmem_free\nownership."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local socket syscalls on an AF_PACKET socket, including setsockopt(), sending traffic that is tapped as PACKET_OUTGOING, and recvmsg(). Remote packets alone do not reach the bug without a local attacker-controlled packet socket.\nAC:L - The attacker controls the socket options, packet-socket receive queue pressure/drop count, and outgoing traffic needed to make the timestamp cmsg path run. No uncontrollable race or rare environmental condition is required for the highest-impact disclosure/crash scenario.\nPR:L - Creating AF_PACKET sockets requires CAP_NET_RAW in the governing user namespace. Because this capability can be obtained by an unprivileged local user in user/network namespaces on common deployments, this is Low rather than High.\nUI:N - No victim action is required after the attacker has local execution; the attacker can configure the socket and trigger recvmsg() themselves. The bug is not dependent on opening a file, mounting media, or other user-assisted behavior.\nS:U - The impact remains within the kernel and the local host security authority. It does not cross a hypervisor, VM, IOMMU, or other separate security scope boundary.\nC:H - The bogus SCM_TIMESTAMPING_OPT_STATS cmsg can copy skb-\u003elen bytes from skb-\u003edata even when the skb is non-linear, reading past the linear head. That can disclose adjacent kernel heap contents to userspace, which is a high confidentiality impact.\nI:N - The investigated bug is an out-of-bounds read/copy-to-user and misclassification of skb metadata, not a kernel write primitive. I found no direct modification of kernel memory or protected data.\nA:H - The same invalid copy can trigger hardened usercopy failures or kernel oops/panic on hardened deployments. The local attacker can repeat the trigger, so availability impact is High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:15.752Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/24a0d548d3a765cd4558224e4f8e06e14cba26e3"
},
{
"url": "https://git.kernel.org/stable/c/71ff5cdd5da61d0438e902aa0fd68c28bc901abe"
},
{
"url": "https://git.kernel.org/stable/c/ad9a0374ee6d11048e1f74cd5180bad58b9848b4"
},
{
"url": "https://git.kernel.org/stable/c/b903e9b5629ec8dd6db92174070045bf81ad7060"
},
{
"url": "https://git.kernel.org/stable/c/e0665b2a8e90bb08bd205062c75662b502d31797"
},
{
"url": "https://git.kernel.org/stable/c/3dde4fb941fa5649ab809f6cd3e20e0c424a4e31"
},
{
"url": "https://git.kernel.org/stable/c/eb51a9ad3ceb01bc6c0fb608dbc856e03ee6f24a"
},
{
"url": "https://git.kernel.org/stable/c/1ee90b77b727df903033db873c75caac5c27ec98"
}
],
"title": "net: guard timestamp cmsgs to real error queue skbs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53223",
"datePublished": "2026-06-25T08:39:24.588Z",
"dateReserved": "2026-06-09T07:44:35.392Z",
"dateUpdated": "2026-08-05T12:34:15.752Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53291 (GCVE-0-2026-53291)
Vulnerability from cvelistv5
Published
2026-06-26 19:40
Modified
2026-06-26 19:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda/conexant: Fix missing error check for jack detection
In cx_probe(), the return value of snd_hda_jack_detect_enable_callback()
is ignored. This function returns a pointer, and if it fails (e.g., due
to memory allocation failure), it returns an error pointer which must
be checked using IS_ERR().
If the registration fails, the driver continues to probe, but the jack
detection callback will not be registered. This can lead to a kernel
crash later when the driver attempts to handle jack events or accesses
the uninitialized structure.
Check the return value using IS_ERR() and propagate the error via
PTR_ERR() to the probe caller.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f13b8cb5a6920ad98b751d3134686f29810577d4 Version: 2cb659ef0ac744545499e7c37665b276d9e405da Version: 24d748413cc4e1d97074bae1f335d32d30912f10 Version: 7aeb259086487417f0fecf66e325bee133e8813a Version: 7aeb259086487417f0fecf66e325bee133e8813a Version: 7aeb259086487417f0fecf66e325bee133e8813a Version: 7aeb259086487417f0fecf66e325bee133e8813a Version: 4a28302b2c681e3cf85e3b41231fff363c4c6a0e Version: 5.15.149 ≤ Version: 6.1.77 ≤ Version: 6.6.16 ≤ Version: 6.7.4 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/hda/codecs/conexant.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "49c2c5924552e1d2f8b635dee663abebbb7cf63b",
"status": "affected",
"version": "f13b8cb5a6920ad98b751d3134686f29810577d4",
"versionType": "git"
},
{
"lessThan": "a2a33e87a2ffce3046c574d24eec4390c27c9365",
"status": "affected",
"version": "2cb659ef0ac744545499e7c37665b276d9e405da",
"versionType": "git"
},
{
"lessThan": "d68f753d89f4ef6e410d7e8b7e8ab2fdde921b80",
"status": "affected",
"version": "24d748413cc4e1d97074bae1f335d32d30912f10",
"versionType": "git"
},
{
"lessThan": "dd110cc00cf854a8ecd8d003127a4178c28574ea",
"status": "affected",
"version": "7aeb259086487417f0fecf66e325bee133e8813a",
"versionType": "git"
},
{
"lessThan": "f837c7b85143a7c54140ff41ad5c076b73cd9933",
"status": "affected",
"version": "7aeb259086487417f0fecf66e325bee133e8813a",
"versionType": "git"
},
{
"lessThan": "1da5c73f3793b224696617a2a21def7500ba18d6",
"status": "affected",
"version": "7aeb259086487417f0fecf66e325bee133e8813a",
"versionType": "git"
},
{
"lessThan": "b0e2333a231107adedd38c6fcfe1adc6162716fc",
"status": "affected",
"version": "7aeb259086487417f0fecf66e325bee133e8813a",
"versionType": "git"
},
{
"status": "affected",
"version": "4a28302b2c681e3cf85e3b41231fff363c4c6a0e",
"versionType": "git"
},
{
"lessThan": "5.15.209",
"status": "affected",
"version": "5.15.149",
"versionType": "semver"
},
{
"lessThan": "6.1.175",
"status": "affected",
"version": "6.1.77",
"versionType": "semver"
},
{
"lessThan": "6.6.141",
"status": "affected",
"version": "6.6.16",
"versionType": "semver"
},
{
"lessThan": "6.8",
"status": "affected",
"version": "6.7.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/hda/codecs/conexant.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.15.149",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1.77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "6.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: hda/conexant: Fix missing error check for jack detection\n\nIn cx_probe(), the return value of snd_hda_jack_detect_enable_callback()\nis ignored. This function returns a pointer, and if it fails (e.g., due\nto memory allocation failure), it returns an error pointer which must\nbe checked using IS_ERR().\n\nIf the registration fails, the driver continues to probe, but the jack\ndetection callback will not be registered. This can lead to a kernel\ncrash later when the driver attempts to handle jack events or accesses\nthe uninitialized structure.\n\nCheck the return value using IS_ERR() and propagate the error via\nPTR_ERR() to the probe caller."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-26T19:40:50.808Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/49c2c5924552e1d2f8b635dee663abebbb7cf63b"
},
{
"url": "https://git.kernel.org/stable/c/a2a33e87a2ffce3046c574d24eec4390c27c9365"
},
{
"url": "https://git.kernel.org/stable/c/d68f753d89f4ef6e410d7e8b7e8ab2fdde921b80"
},
{
"url": "https://git.kernel.org/stable/c/dd110cc00cf854a8ecd8d003127a4178c28574ea"
},
{
"url": "https://git.kernel.org/stable/c/f837c7b85143a7c54140ff41ad5c076b73cd9933"
},
{
"url": "https://git.kernel.org/stable/c/1da5c73f3793b224696617a2a21def7500ba18d6"
},
{
"url": "https://git.kernel.org/stable/c/b0e2333a231107adedd38c6fcfe1adc6162716fc"
}
],
"title": "ALSA: hda/conexant: Fix missing error check for jack detection",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53291",
"datePublished": "2026-06-26T19:40:50.808Z",
"dateReserved": "2026-06-09T07:44:35.396Z",
"dateUpdated": "2026-06-26T19:40:50.808Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53353 (GCVE-0-2026-53353)
Vulnerability from cvelistv5
Published
2026-07-01 13:32
Modified
2026-07-01 13:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
hsr: Remove WARN_ONCE() in hsr_addr_is_self().
syzbot reported the warning [0] in hsr_addr_is_self(),
whose assumption is simply wrong.
hsr->self_node is cleared in hsr_del_self_node(), which
is called from hsr_dellink().
Since dev->rtnl_link_ops->dellink() is called before
unregister_netdevice_many(), there is a window when
user can find the device but without hsr->self_node.
Let's remove WARN_ONCE() in hsr_addr_is_self().
[0]:
HSR: No self node
WARNING: net/hsr/hsr_framereg.c:39 at hsr_addr_is_self+0x211/0x3f0 net/hsr/hsr_framereg.c:39, CPU#0: syz.4.16848/17220
Modules linked in:
CPU: 0 UID: 0 PID: 17220 Comm: syz.4.16848 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:hsr_addr_is_self+0x211/0x3f0 net/hsr/hsr_framereg.c:39
Code: 33 2f 41 0f b7 dd 89 ee 09 de 31 ff e8 c8 b4 c6 f6 09 dd 74 54 e8 0f b0 c6 f6 31 ed eb 53 e8 06 b0 c6 f6 48 8d 3d 2f 50 9c 04 <67> 48 0f b9 3a 31 ed eb 42 e8 c1 13 1f 00 89 c5 31 ff 89 c6 e8 96
RSP: 0018:ffffc900041c70e0 EFLAGS: 00010283
RAX: ffffffff8afdc6ca RBX: ffffffff8afdc4e6 RCX: 0000000000080000
RDX: ffffc90010493000 RSI: 0000000000000948 RDI: ffffffff8f9a1700
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
R10: ffffc900041c71e8 R11: fffff52000838e3f R12: dffffc0000000000
R13: ffff888041f9e3c0 R14: ffff888086ee3802 R15: 0000000000000000
FS: 00007f6fe985d6c0(0000) GS:ffff888126176000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f80bd437dac CR3: 0000000025096000 CR4: 00000000003526f0
DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000002
DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
check_local_dest net/hsr/hsr_forward.c:592 [inline]
fill_frame_info net/hsr/hsr_forward.c:728 [inline]
hsr_forward_skb+0xa11/0x2a80 net/hsr/hsr_forward.c:739
hsr_dev_xmit+0x253/0x370 net/hsr/hsr_device.c:236
__netdev_start_xmit include/linux/netdevice.h:5368 [inline]
netdev_start_xmit include/linux/netdevice.h:5377 [inline]
xmit_one net/core/dev.c:3888 [inline]
dev_hard_start_xmit+0x2df/0x860 net/core/dev.c:3904
__dev_queue_xmit+0x1428/0x3900 net/core/dev.c:4870
neigh_output include/net/neighbour.h:556 [inline]
ip_finish_output2+0xcec/0x10b0 net/ipv4/ip_output.c:237
ip_send_skb net/ipv4/ip_output.c:1510 [inline]
ip_push_pending_frames+0x8b/0x110 net/ipv4/ip_output.c:1530
raw_sendmsg+0x1547/0x1a50 net/ipv4/raw.c:659
sock_sendmsg_nosec net/socket.c:787 [inline]
__sock_sendmsg net/socket.c:802 [inline]
____sys_sendmsg+0x7da/0x9c0 net/socket.c:2698
___sys_sendmsg+0x2a5/0x360 net/socket.c:2752
__sys_sendmsg net/socket.c:2784 [inline]
__do_sys_sendmsg net/socket.c:2789 [inline]
__se_sys_sendmsg net/socket.c:2787 [inline]
__x64_sys_sendmsg+0x1c3/0x2a0 net/socket.c:2787
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6feb62ce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6fe985d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f6feb8a6090 RCX: 00007f6feb62ce59
RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004
RBP: 00007f6feb6c2d6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6feb8a6128 R14: 00007f6feb8a6090 R15: 00007ffcf01cc488
</TASK>
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/hsr/hsr_framereg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "271355c2ef6171dbc815e7ae653eed63444bbd58",
"status": "affected",
"version": "f266a683a4804dc499efc6c2206ef68efed029d0",
"versionType": "git"
},
{
"lessThan": "0232b6fcb7615fb7fecfe0727a23065a53e228b8",
"status": "affected",
"version": "f266a683a4804dc499efc6c2206ef68efed029d0",
"versionType": "git"
},
{
"lessThan": "66a46e22396fd5d09606f37f73643eb20e99aa42",
"status": "affected",
"version": "f266a683a4804dc499efc6c2206ef68efed029d0",
"versionType": "git"
},
{
"lessThan": "d71bb171661ec0225bf4babdd4d296d744982fb3",
"status": "affected",
"version": "f266a683a4804dc499efc6c2206ef68efed029d0",
"versionType": "git"
},
{
"lessThan": "afd0f17ca46258cec3a5cc48b8df9327fe772490",
"status": "affected",
"version": "f266a683a4804dc499efc6c2206ef68efed029d0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/hsr/hsr_framereg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.17"
},
{
"lessThan": "3.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhsr: Remove WARN_ONCE() in hsr_addr_is_self().\n\nsyzbot reported the warning [0] in hsr_addr_is_self(),\nwhose assumption is simply wrong.\n\nhsr-\u003eself_node is cleared in hsr_del_self_node(), which\nis called from hsr_dellink().\n\nSince dev-\u003ertnl_link_ops-\u003edellink() is called before\nunregister_netdevice_many(), there is a window when\nuser can find the device but without hsr-\u003eself_node.\n\nLet\u0027s remove WARN_ONCE() in hsr_addr_is_self().\n\n[0]:\nHSR: No self node\nWARNING: net/hsr/hsr_framereg.c:39 at hsr_addr_is_self+0x211/0x3f0 net/hsr/hsr_framereg.c:39, CPU#0: syz.4.16848/17220\nModules linked in:\nCPU: 0 UID: 0 PID: 17220 Comm: syz.4.16848 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}\nTainted: [L]=SOFTLOCKUP\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026\nRIP: 0010:hsr_addr_is_self+0x211/0x3f0 net/hsr/hsr_framereg.c:39\nCode: 33 2f 41 0f b7 dd 89 ee 09 de 31 ff e8 c8 b4 c6 f6 09 dd 74 54 e8 0f b0 c6 f6 31 ed eb 53 e8 06 b0 c6 f6 48 8d 3d 2f 50 9c 04 \u003c67\u003e 48 0f b9 3a 31 ed eb 42 e8 c1 13 1f 00 89 c5 31 ff 89 c6 e8 96\nRSP: 0018:ffffc900041c70e0 EFLAGS: 00010283\nRAX: ffffffff8afdc6ca RBX: ffffffff8afdc4e6 RCX: 0000000000080000\nRDX: ffffc90010493000 RSI: 0000000000000948 RDI: ffffffff8f9a1700\nRBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000\nR10: ffffc900041c71e8 R11: fffff52000838e3f R12: dffffc0000000000\nR13: ffff888041f9e3c0 R14: ffff888086ee3802 R15: 0000000000000000\nFS: 00007f6fe985d6c0(0000) GS:ffff888126176000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f80bd437dac CR3: 0000000025096000 CR4: 00000000003526f0\nDR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000002\nDR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n check_local_dest net/hsr/hsr_forward.c:592 [inline]\n fill_frame_info net/hsr/hsr_forward.c:728 [inline]\n hsr_forward_skb+0xa11/0x2a80 net/hsr/hsr_forward.c:739\n hsr_dev_xmit+0x253/0x370 net/hsr/hsr_device.c:236\n __netdev_start_xmit include/linux/netdevice.h:5368 [inline]\n netdev_start_xmit include/linux/netdevice.h:5377 [inline]\n xmit_one net/core/dev.c:3888 [inline]\n dev_hard_start_xmit+0x2df/0x860 net/core/dev.c:3904\n __dev_queue_xmit+0x1428/0x3900 net/core/dev.c:4870\n neigh_output include/net/neighbour.h:556 [inline]\n ip_finish_output2+0xcec/0x10b0 net/ipv4/ip_output.c:237\n ip_send_skb net/ipv4/ip_output.c:1510 [inline]\n ip_push_pending_frames+0x8b/0x110 net/ipv4/ip_output.c:1530\n raw_sendmsg+0x1547/0x1a50 net/ipv4/raw.c:659\n sock_sendmsg_nosec net/socket.c:787 [inline]\n __sock_sendmsg net/socket.c:802 [inline]\n ____sys_sendmsg+0x7da/0x9c0 net/socket.c:2698\n ___sys_sendmsg+0x2a5/0x360 net/socket.c:2752\n __sys_sendmsg net/socket.c:2784 [inline]\n __do_sys_sendmsg net/socket.c:2789 [inline]\n __se_sys_sendmsg net/socket.c:2787 [inline]\n __x64_sys_sendmsg+0x1c3/0x2a0 net/socket.c:2787\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f6feb62ce59\nCode: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f6fe985d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00007f6feb8a6090 RCX: 00007f6feb62ce59\nRDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004\nRBP: 00007f6feb6c2d6f R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007f6feb8a6128 R14: 00007f6feb8a6090 R15: 00007ffcf01cc488\n \u003c/TASK\u003e"
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T13:32:29.699Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/271355c2ef6171dbc815e7ae653eed63444bbd58"
},
{
"url": "https://git.kernel.org/stable/c/0232b6fcb7615fb7fecfe0727a23065a53e228b8"
},
{
"url": "https://git.kernel.org/stable/c/66a46e22396fd5d09606f37f73643eb20e99aa42"
},
{
"url": "https://git.kernel.org/stable/c/d71bb171661ec0225bf4babdd4d296d744982fb3"
},
{
"url": "https://git.kernel.org/stable/c/afd0f17ca46258cec3a5cc48b8df9327fe772490"
}
],
"title": "hsr: Remove WARN_ONCE() in hsr_addr_is_self().",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53353",
"datePublished": "2026-07-01T13:32:29.699Z",
"dateReserved": "2026-06-09T07:44:35.400Z",
"dateUpdated": "2026-07-01T13:32:29.699Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53086 (GCVE-0-2026-53086)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: bcmgenet: fix racing timeout handler
The bcmgenet_timeout handler tries to take down all tx queues when
a single queue times out. This is over zealous and causes many race
conditions with queues that are still chugging along. Instead lets
only restart the timed out queue.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 13ea657806cf73b379a0109f7042182f47c351a7 Version: 13ea657806cf73b379a0109f7042182f47c351a7 Version: 13ea657806cf73b379a0109f7042182f47c351a7 Version: 13ea657806cf73b379a0109f7042182f47c351a7 Version: 13ea657806cf73b379a0109f7042182f47c351a7 Version: 13ea657806cf73b379a0109f7042182f47c351a7 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/genet/bcmgenet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e85b0c0a12e967930044608311471b665baa315c",
"status": "affected",
"version": "13ea657806cf73b379a0109f7042182f47c351a7",
"versionType": "git"
},
{
"lessThan": "e8206538cbaf4f4068e99a4cb1138690a1e00499",
"status": "affected",
"version": "13ea657806cf73b379a0109f7042182f47c351a7",
"versionType": "git"
},
{
"lessThan": "681fdfe823b4f1036ed50b58b8838c7917ea389c",
"status": "affected",
"version": "13ea657806cf73b379a0109f7042182f47c351a7",
"versionType": "git"
},
{
"lessThan": "c270e2bec3e55a716d25c35341091339457ac883",
"status": "affected",
"version": "13ea657806cf73b379a0109f7042182f47c351a7",
"versionType": "git"
},
{
"lessThan": "7ce1c26aac3b318886a57425f64b522da7389153",
"status": "affected",
"version": "13ea657806cf73b379a0109f7042182f47c351a7",
"versionType": "git"
},
{
"lessThan": "5393b2b5bee2ac51a0043dc7f4ac3475f053d08d",
"status": "affected",
"version": "13ea657806cf73b379a0109f7042182f47c351a7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/genet/bcmgenet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmgenet: fix racing timeout handler\n\nThe bcmgenet_timeout handler tries to take down all tx queues when\na single queue times out. This is over zealous and causes many race\nconditions with queues that are still chugging along. Instead lets\nonly restart the timed out queue."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable path is the Ethernet TX path and `ndo_tx_timeout` recovery for a network interface; a remote peer can cause the affected host or router to transmit traffic through bcmgenet without local code execution. In an internet-facing or routed embedded deployment, this is reachable via network traffic.\nAC:L - The race is between timeout recovery on one TX queue and other active TX queues, and an attacker can plausibly create sustained concurrent traffic to exercise multiple queues and keep the race repeatable. No special memory layout or victim interaction is required beyond traffic-induced queue activity.\nPR:N - No kernel privilege check gates the watchdog timeout handler once the interface is up. A remote unauthenticated peer can trigger outbound responses or forwarded traffic in a reasonable deployment.\nUI:N - Exploitation does not require a user to open a file, mount anything, or take an interactive action. The vulnerable recovery runs asynchronously from normal network transmission and watchdog handling.\nS:U - The impact remains within the same host kernel and network device security authority. This is not a VM escape, IOMMU boundary bypass, or cross-scope sandbox escape.\nC:H - The old handler reclaimed and freed in-flight SKBs/descriptors for queues that could still be transmitting, creating a DMA/use-after-free condition. Freed or reused kernel memory could plausibly be transmitted or otherwise exposed, so confidentiality is high.\nI:H - Freeing and reusing active TX control blocks while hardware still owns them is UAF-style memory corruption of kernel driver/DMA state. Under the required conservative scoring, this is treated as potentially enabling high-integrity impact rather than mere packet loss.\nA:H - The race can corrupt TX ring accounting/state, trigger repeated TX watchdog failures, DMA/IOMMU faults, hangs, or kernel crashes. This is a high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:14.446Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e85b0c0a12e967930044608311471b665baa315c"
},
{
"url": "https://git.kernel.org/stable/c/e8206538cbaf4f4068e99a4cb1138690a1e00499"
},
{
"url": "https://git.kernel.org/stable/c/681fdfe823b4f1036ed50b58b8838c7917ea389c"
},
{
"url": "https://git.kernel.org/stable/c/c270e2bec3e55a716d25c35341091339457ac883"
},
{
"url": "https://git.kernel.org/stable/c/7ce1c26aac3b318886a57425f64b522da7389153"
},
{
"url": "https://git.kernel.org/stable/c/5393b2b5bee2ac51a0043dc7f4ac3475f053d08d"
}
],
"title": "net: bcmgenet: fix racing timeout handler",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53086",
"datePublished": "2026-06-24T16:30:26.111Z",
"dateReserved": "2026-06-09T07:44:35.384Z",
"dateUpdated": "2026-08-05T12:33:14.446Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53128 (GCVE-0-2026-53128)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-06-24 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drbd: Balance RCU calls in drbd_adm_dump_devices()
Make drbd_adm_dump_devices() call rcu_read_lock() before
rcu_read_unlock() is called. This has been detected by the Clang
thread-safety analyzer.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a55bbd375d1802141f0f043e2cd08f85c23d6209 Version: a55bbd375d1802141f0f043e2cd08f85c23d6209 Version: a55bbd375d1802141f0f043e2cd08f85c23d6209 Version: a55bbd375d1802141f0f043e2cd08f85c23d6209 Version: a55bbd375d1802141f0f043e2cd08f85c23d6209 Version: a55bbd375d1802141f0f043e2cd08f85c23d6209 Version: a55bbd375d1802141f0f043e2cd08f85c23d6209 Version: a55bbd375d1802141f0f043e2cd08f85c23d6209 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/block/drbd/drbd_nl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ae12bb44b392637a8321ade305c883f9ffc0daea",
"status": "affected",
"version": "a55bbd375d1802141f0f043e2cd08f85c23d6209",
"versionType": "git"
},
{
"lessThan": "68ebb9183ac3621b96b18e046841eadb9508783c",
"status": "affected",
"version": "a55bbd375d1802141f0f043e2cd08f85c23d6209",
"versionType": "git"
},
{
"lessThan": "6cd27bcb71bb73f955d104cc3a62be6f83724392",
"status": "affected",
"version": "a55bbd375d1802141f0f043e2cd08f85c23d6209",
"versionType": "git"
},
{
"lessThan": "282e06e6d494a7bee85af78c747527b7d4009cc3",
"status": "affected",
"version": "a55bbd375d1802141f0f043e2cd08f85c23d6209",
"versionType": "git"
},
{
"lessThan": "8092713a10c19fa0f731b71b2853af4319ca54fd",
"status": "affected",
"version": "a55bbd375d1802141f0f043e2cd08f85c23d6209",
"versionType": "git"
},
{
"lessThan": "996d279f2c985d771d6cfdd923e447d825726e06",
"status": "affected",
"version": "a55bbd375d1802141f0f043e2cd08f85c23d6209",
"versionType": "git"
},
{
"lessThan": "1f112240531f0a0b437b2e001c1d89e8b25a8328",
"status": "affected",
"version": "a55bbd375d1802141f0f043e2cd08f85c23d6209",
"versionType": "git"
},
{
"lessThan": "2b31e86387e60b3689339f0f0fbb4d3623d9d494",
"status": "affected",
"version": "a55bbd375d1802141f0f043e2cd08f85c23d6209",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/block/drbd/drbd_nl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.5"
},
{
"lessThan": "4.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrbd: Balance RCU calls in drbd_adm_dump_devices()\n\nMake drbd_adm_dump_devices() call rcu_read_lock() before\nrcu_read_unlock() is called. This has been detected by the Clang\nthread-safety analyzer."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:55.911Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ae12bb44b392637a8321ade305c883f9ffc0daea"
},
{
"url": "https://git.kernel.org/stable/c/68ebb9183ac3621b96b18e046841eadb9508783c"
},
{
"url": "https://git.kernel.org/stable/c/6cd27bcb71bb73f955d104cc3a62be6f83724392"
},
{
"url": "https://git.kernel.org/stable/c/282e06e6d494a7bee85af78c747527b7d4009cc3"
},
{
"url": "https://git.kernel.org/stable/c/8092713a10c19fa0f731b71b2853af4319ca54fd"
},
{
"url": "https://git.kernel.org/stable/c/996d279f2c985d771d6cfdd923e447d825726e06"
},
{
"url": "https://git.kernel.org/stable/c/1f112240531f0a0b437b2e001c1d89e8b25a8328"
},
{
"url": "https://git.kernel.org/stable/c/2b31e86387e60b3689339f0f0fbb4d3623d9d494"
}
],
"title": "drbd: Balance RCU calls in drbd_adm_dump_devices()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53128",
"datePublished": "2026-06-24T16:30:55.911Z",
"dateReserved": "2026-06-09T07:44:35.386Z",
"dateUpdated": "2026-06-24T16:30:55.911Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53111 (GCVE-0-2026-53111)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-06-24 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap
The bpf_lwt_xmit_push_encap helper needs to access skb_dst(skb)->dev to
calculate the needed headroom:
err = skb_cow_head(skb,
len + LL_RESERVED_SPACE(skb_dst(skb)->dev));
But skb->_skb_refdst may not be initialized when the skb is set up by
bpf_prog_test_run_skb function. Executing bpf_lwt_push_ip_encap function
in this scenario will trigger null pointer dereference, causing a kernel
crash as Yinhao reported:
[ 105.186365] BUG: kernel NULL pointer dereference, address: 0000000000000000
[ 105.186382] #PF: supervisor read access in kernel mode
[ 105.186388] #PF: error_code(0x0000) - not-present page
[ 105.186393] PGD 121d3d067 P4D 121d3d067 PUD 106c83067 PMD 0
[ 105.186404] Oops: 0000 [#1] PREEMPT SMP NOPTI
[ 105.186412] CPU: 3 PID: 3250 Comm: poc Kdump: loaded Not tainted 6.19.0-rc5 #1
[ 105.186423] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 105.186427] RIP: 0010:bpf_lwt_push_ip_encap+0x1eb/0x520
[ 105.186443] Code: 0f 84 de 01 00 00 0f b7 4a 04 66 85 c9 0f 85 47 01 00 00 31 c0 5b 5d 41 5c 41 5d 41 5e c3 cc cc cc cc 48 8b 73 58 48 83 e6 fe <48> 8b 36 0f b7 be ec 00 00 00 0f b7 b6 e6 00 00 00 01 fe 83 e6 f0
[ 105.186449] RSP: 0018:ffffbb0e0387bc50 EFLAGS: 00010246
[ 105.186455] RAX: 000000000000004e RBX: ffff94c74e036500 RCX: ffff94c74874da00
[ 105.186460] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff94c74e036500
[ 105.186463] RBP: 0000000000000001 R08: 0000000000000002 R09: 0000000000000000
[ 105.186467] R10: ffffbb0e0387bd50 R11: 0000000000000000 R12: ffffbb0e0387bc98
[ 105.186471] R13: 0000000000000014 R14: 0000000000000000 R15: 0000000000000002
[ 105.186484] FS: 00007f166aa4d680(0000) GS:ffff94c8b7780000(0000) knlGS:0000000000000000
[ 105.186490] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 105.186494] CR2: 0000000000000000 CR3: 000000015eade001 CR4: 0000000000770ee0
[ 105.186499] PKRU: 55555554
[ 105.186502] Call Trace:
[ 105.186507] <TASK>
[ 105.186513] bpf_lwt_xmit_push_encap+0x2b/0x40
[ 105.186522] bpf_prog_a75eaad51e517912+0x41/0x49
[ 105.186536] ? kvm_clock_get_cycles+0x18/0x30
[ 105.186547] ? ktime_get+0x3c/0xa0
[ 105.186554] bpf_test_run+0x195/0x320
[ 105.186563] ? bpf_test_run+0x10f/0x320
[ 105.186579] bpf_prog_test_run_skb+0x2f5/0x4f0
[ 105.186590] __sys_bpf+0x69c/0xa40
[ 105.186603] __x64_sys_bpf+0x1e/0x30
[ 105.186611] do_syscall_64+0x59/0x110
[ 105.186620] entry_SYSCALL_64_after_hwframe+0x76/0xe0
[ 105.186649] RIP: 0033:0x7f166a97455d
Temporarily add the setting of skb->_skb_refdst before bpf_test_run to resolve the issue.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 52f278774e796a553be0c869dcaaee6f259ca795 Version: 52f278774e796a553be0c869dcaaee6f259ca795 Version: 52f278774e796a553be0c869dcaaee6f259ca795 Version: 52f278774e796a553be0c869dcaaee6f259ca795 Version: 52f278774e796a553be0c869dcaaee6f259ca795 Version: 52f278774e796a553be0c869dcaaee6f259ca795 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bpf/test_run.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5c8d1f91fc4898d79f29d79c1a6f7c2b3ee66fb0",
"status": "affected",
"version": "52f278774e796a553be0c869dcaaee6f259ca795",
"versionType": "git"
},
{
"lessThan": "c7ad31fb948fdd4905263f4324160682c3fa7bc6",
"status": "affected",
"version": "52f278774e796a553be0c869dcaaee6f259ca795",
"versionType": "git"
},
{
"lessThan": "599905c3f10bb83e6e6881d5a7f5cea5df07dc23",
"status": "affected",
"version": "52f278774e796a553be0c869dcaaee6f259ca795",
"versionType": "git"
},
{
"lessThan": "5500913516e071dbe23e5a404c861dd2d82c9589",
"status": "affected",
"version": "52f278774e796a553be0c869dcaaee6f259ca795",
"versionType": "git"
},
{
"lessThan": "94f95328b9070909b5b875c647b17a11d3d85567",
"status": "affected",
"version": "52f278774e796a553be0c869dcaaee6f259ca795",
"versionType": "git"
},
{
"lessThan": "972787479ee73006fddb5e59ab5c8e733810ff42",
"status": "affected",
"version": "52f278774e796a553be0c869dcaaee6f259ca795",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bpf/test_run.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.1"
},
{
"lessThan": "5.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap\n\nThe bpf_lwt_xmit_push_encap helper needs to access skb_dst(skb)-\u003edev to\ncalculate the needed headroom:\n\n\terr = skb_cow_head(skb,\n\t\t\t len + LL_RESERVED_SPACE(skb_dst(skb)-\u003edev));\n\nBut skb-\u003e_skb_refdst may not be initialized when the skb is set up by\nbpf_prog_test_run_skb function. Executing bpf_lwt_push_ip_encap function\nin this scenario will trigger null pointer dereference, causing a kernel\ncrash as Yinhao reported:\n\n[ 105.186365] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[ 105.186382] #PF: supervisor read access in kernel mode\n[ 105.186388] #PF: error_code(0x0000) - not-present page\n[ 105.186393] PGD 121d3d067 P4D 121d3d067 PUD 106c83067 PMD 0\n[ 105.186404] Oops: 0000 [#1] PREEMPT SMP NOPTI\n[ 105.186412] CPU: 3 PID: 3250 Comm: poc Kdump: loaded Not tainted 6.19.0-rc5 #1\n[ 105.186423] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[ 105.186427] RIP: 0010:bpf_lwt_push_ip_encap+0x1eb/0x520\n[ 105.186443] Code: 0f 84 de 01 00 00 0f b7 4a 04 66 85 c9 0f 85 47 01 00 00 31 c0 5b 5d 41 5c 41 5d 41 5e c3 cc cc cc cc 48 8b 73 58 48 83 e6 fe \u003c48\u003e 8b 36 0f b7 be ec 00 00 00 0f b7 b6 e6 00 00 00 01 fe 83 e6 f0\n[ 105.186449] RSP: 0018:ffffbb0e0387bc50 EFLAGS: 00010246\n[ 105.186455] RAX: 000000000000004e RBX: ffff94c74e036500 RCX: ffff94c74874da00\n[ 105.186460] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff94c74e036500\n[ 105.186463] RBP: 0000000000000001 R08: 0000000000000002 R09: 0000000000000000\n[ 105.186467] R10: ffffbb0e0387bd50 R11: 0000000000000000 R12: ffffbb0e0387bc98\n[ 105.186471] R13: 0000000000000014 R14: 0000000000000000 R15: 0000000000000002\n[ 105.186484] FS: 00007f166aa4d680(0000) GS:ffff94c8b7780000(0000) knlGS:0000000000000000\n[ 105.186490] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 105.186494] CR2: 0000000000000000 CR3: 000000015eade001 CR4: 0000000000770ee0\n[ 105.186499] PKRU: 55555554\n[ 105.186502] Call Trace:\n[ 105.186507] \u003cTASK\u003e\n[ 105.186513] bpf_lwt_xmit_push_encap+0x2b/0x40\n[ 105.186522] bpf_prog_a75eaad51e517912+0x41/0x49\n[ 105.186536] ? kvm_clock_get_cycles+0x18/0x30\n[ 105.186547] ? ktime_get+0x3c/0xa0\n[ 105.186554] bpf_test_run+0x195/0x320\n[ 105.186563] ? bpf_test_run+0x10f/0x320\n[ 105.186579] bpf_prog_test_run_skb+0x2f5/0x4f0\n[ 105.186590] __sys_bpf+0x69c/0xa40\n[ 105.186603] __x64_sys_bpf+0x1e/0x30\n[ 105.186611] do_syscall_64+0x59/0x110\n[ 105.186620] entry_SYSCALL_64_after_hwframe+0x76/0xe0\n[ 105.186649] RIP: 0033:0x7f166a97455d\n\nTemporarily add the setting of skb-\u003e_skb_refdst before bpf_test_run to resolve the issue."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:44.691Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5c8d1f91fc4898d79f29d79c1a6f7c2b3ee66fb0"
},
{
"url": "https://git.kernel.org/stable/c/c7ad31fb948fdd4905263f4324160682c3fa7bc6"
},
{
"url": "https://git.kernel.org/stable/c/599905c3f10bb83e6e6881d5a7f5cea5df07dc23"
},
{
"url": "https://git.kernel.org/stable/c/5500913516e071dbe23e5a404c861dd2d82c9589"
},
{
"url": "https://git.kernel.org/stable/c/94f95328b9070909b5b875c647b17a11d3d85567"
},
{
"url": "https://git.kernel.org/stable/c/972787479ee73006fddb5e59ab5c8e733810ff42"
}
],
"title": "bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53111",
"datePublished": "2026-06-24T16:30:44.691Z",
"dateReserved": "2026-06-09T07:44:35.385Z",
"dateUpdated": "2026-06-24T16:30:44.691Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52968 (GCVE-0-2026-52968)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic
kvm_s390_pci_aif_enable(), kvm_s390_pci_aif_disable(), and
aen_host_forward() index the GAIT by manually multiplying the index
with sizeof(struct zpci_gaite).
Since aift->gait is already a struct zpci_gaite pointer, this
double-scales the offset, accessing element aisb*16 instead of aisb.
This causes out-of-bounds accesses when aisb >= 32 (with
ZPCI_NR_DEVICES=512)
Fix by removing the erroneous sizeof multiplication.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 73f91b004321f2510fa79e66035dbbf1870fcf56 Version: 73f91b004321f2510fa79e66035dbbf1870fcf56 Version: 73f91b004321f2510fa79e66035dbbf1870fcf56 Version: 73f91b004321f2510fa79e66035dbbf1870fcf56 Version: 73f91b004321f2510fa79e66035dbbf1870fcf56 Version: 73f91b004321f2510fa79e66035dbbf1870fcf56 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/s390/kvm/interrupt.c",
"arch/s390/kvm/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "31a9d9f9942885aae356a1a57c79e82c5b5b0828",
"status": "affected",
"version": "73f91b004321f2510fa79e66035dbbf1870fcf56",
"versionType": "git"
},
{
"lessThan": "a99a25db131ece5e6c0f7632da606de631efe4f2",
"status": "affected",
"version": "73f91b004321f2510fa79e66035dbbf1870fcf56",
"versionType": "git"
},
{
"lessThan": "11b8ff5b930b351dd1f6f088dce0beb027ac92d0",
"status": "affected",
"version": "73f91b004321f2510fa79e66035dbbf1870fcf56",
"versionType": "git"
},
{
"lessThan": "b22a2da8792a7bfe743c1a922e77fa499ddedbe8",
"status": "affected",
"version": "73f91b004321f2510fa79e66035dbbf1870fcf56",
"versionType": "git"
},
{
"lessThan": "e7216651b94e92e5433fb2f54b77864642b4ea48",
"status": "affected",
"version": "73f91b004321f2510fa79e66035dbbf1870fcf56",
"versionType": "git"
},
{
"lessThan": "16d990a15491cf76cd6eef0846e1b4100e63261a",
"status": "affected",
"version": "73f91b004321f2510fa79e66035dbbf1870fcf56",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/s390/kvm/interrupt.c",
"arch/s390/kvm/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic\n\nkvm_s390_pci_aif_enable(), kvm_s390_pci_aif_disable(), and\naen_host_forward() index the GAIT by manually multiplying the index\nwith sizeof(struct zpci_gaite).\n\nSince aift-\u003egait is already a struct zpci_gaite pointer, this\ndouble-scales the offset, accessing element aisb*16 instead of aisb.\n\nThis causes out-of-bounds accesses when aisb \u003e= 32 (with\nZPCI_NR_DEVICES=512)\n\nFix by removing the erroneous sizeof multiplication."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached through local KVM/VFIO s390 zPCI management paths, specifically the `KVM_S390_ZPCI_OP` VM ioctl and host interrupt forwarding, not through network packets.\nAC:L - Once zPCI AEN interpretation is available and an AISB index of 32 or higher is allocated, the bad pointer arithmetic deterministically accesses the wrong GAIT entry; no attacker-uncontrolled race is required.\nPR:L - The attacker needs local ability to operate a KVM VM with an associated VFIO zPCI device or equivalent VM-management access, but the vulnerable ioctl itself does not require a real init-namespace root capability check.\nUI:N - After the attacker can issue the relevant KVM/VFIO operations or trigger adapter events for the assigned device, exploitation does not require a separate victim user action.\nS:C - This is KVM host-side memory corruption in a virtualization/device-assignment path, so a plausible exploit crosses the VM or assigned-device security boundary into host kernel resources.\nC:H - The bug performs out-of-bounds reads from page-allocator memory through the misindexed GAIT entry and can expose host kernel memory contents or pointers.\nI:H - The registration and deregistration paths perform out-of-bounds writes to fields including `gisa`, `gisc`, `count`, `aisbo`, and `aisb`, making host kernel memory corruption and potential code execution defensible.\nA:H - The same out-of-bounds reads and writes can corrupt arbitrary adjacent kernel memory or dereference corrupted physical addresses, making host crash or panic a high-probability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:12.815Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/31a9d9f9942885aae356a1a57c79e82c5b5b0828"
},
{
"url": "https://git.kernel.org/stable/c/a99a25db131ece5e6c0f7632da606de631efe4f2"
},
{
"url": "https://git.kernel.org/stable/c/11b8ff5b930b351dd1f6f088dce0beb027ac92d0"
},
{
"url": "https://git.kernel.org/stable/c/b22a2da8792a7bfe743c1a922e77fa499ddedbe8"
},
{
"url": "https://git.kernel.org/stable/c/e7216651b94e92e5433fb2f54b77864642b4ea48"
},
{
"url": "https://git.kernel.org/stable/c/16d990a15491cf76cd6eef0846e1b4100e63261a"
}
],
"title": "KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52968",
"datePublished": "2026-06-24T16:28:47.438Z",
"dateReserved": "2026-06-09T07:44:35.375Z",
"dateUpdated": "2026-08-05T12:32:12.815Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53287 (GCVE-0-2026-53287)
Vulnerability from cvelistv5
Published
2026-06-26 19:40
Modified
2026-06-26 19:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
audit: fix incorrect inheritable capability in CAPSET records
__audit_log_capset() records the effective capability set into the
inheritable field due to a copy-paste error. Every CAPSET audit
record therefore reports cap_pi (process inheritable) with the value
of cap_effective instead of cap_inheritable.
This silently corrupts audit data used for compliance and forensic
analysis: an attacker who modifies inheritable capabilities to
prepare for a privilege-escalating exec would have the change masked
in the audit trail.
The bug has been present since the original introduction of CAPSET
audit records in 2008.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e68b75a027bb94066576139ee33676264f867b87 Version: e68b75a027bb94066576139ee33676264f867b87 Version: e68b75a027bb94066576139ee33676264f867b87 Version: e68b75a027bb94066576139ee33676264f867b87 Version: e68b75a027bb94066576139ee33676264f867b87 Version: e68b75a027bb94066576139ee33676264f867b87 Version: e68b75a027bb94066576139ee33676264f867b87 Version: e68b75a027bb94066576139ee33676264f867b87 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/auditsc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "75bd76c9eb2de9afeca03dc5152ebca5fb8fc816",
"status": "affected",
"version": "e68b75a027bb94066576139ee33676264f867b87",
"versionType": "git"
},
{
"lessThan": "febb4bf373ac565d3fb8d1f429827bdd983be496",
"status": "affected",
"version": "e68b75a027bb94066576139ee33676264f867b87",
"versionType": "git"
},
{
"lessThan": "95de7bb4bf535a9288549d401ebde83cdcbf2792",
"status": "affected",
"version": "e68b75a027bb94066576139ee33676264f867b87",
"versionType": "git"
},
{
"lessThan": "151ee470edc3d7ed29fe72df678f8357d2ad8ced",
"status": "affected",
"version": "e68b75a027bb94066576139ee33676264f867b87",
"versionType": "git"
},
{
"lessThan": "0a065c51a225854768b772a0b733a44d77162582",
"status": "affected",
"version": "e68b75a027bb94066576139ee33676264f867b87",
"versionType": "git"
},
{
"lessThan": "e35f3550c5b4fab33103c18654c293cee9850b0a",
"status": "affected",
"version": "e68b75a027bb94066576139ee33676264f867b87",
"versionType": "git"
},
{
"lessThan": "d782e4d200cd9036ef353eeb29525bfbfd13a14e",
"status": "affected",
"version": "e68b75a027bb94066576139ee33676264f867b87",
"versionType": "git"
},
{
"lessThan": "e4a640475e43f406fdfd56d370b1f34b0cbbc18d",
"status": "affected",
"version": "e68b75a027bb94066576139ee33676264f867b87",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/auditsc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.29"
},
{
"lessThan": "2.6.29",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.29",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naudit: fix incorrect inheritable capability in CAPSET records\n\n__audit_log_capset() records the effective capability set into the\ninheritable field due to a copy-paste error. Every CAPSET audit\nrecord therefore reports cap_pi (process inheritable) with the value\nof cap_effective instead of cap_inheritable.\n\nThis silently corrupts audit data used for compliance and forensic\nanalysis: an attacker who modifies inheritable capabilities to\nprepare for a privilege-escalating exec would have the change masked\nin the audit trail.\n\nThe bug has been present since the original introduction of CAPSET\naudit records in 2008."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-26T19:40:47.946Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/75bd76c9eb2de9afeca03dc5152ebca5fb8fc816"
},
{
"url": "https://git.kernel.org/stable/c/febb4bf373ac565d3fb8d1f429827bdd983be496"
},
{
"url": "https://git.kernel.org/stable/c/95de7bb4bf535a9288549d401ebde83cdcbf2792"
},
{
"url": "https://git.kernel.org/stable/c/151ee470edc3d7ed29fe72df678f8357d2ad8ced"
},
{
"url": "https://git.kernel.org/stable/c/0a065c51a225854768b772a0b733a44d77162582"
},
{
"url": "https://git.kernel.org/stable/c/e35f3550c5b4fab33103c18654c293cee9850b0a"
},
{
"url": "https://git.kernel.org/stable/c/d782e4d200cd9036ef353eeb29525bfbfd13a14e"
},
{
"url": "https://git.kernel.org/stable/c/e4a640475e43f406fdfd56d370b1f34b0cbbc18d"
}
],
"title": "audit: fix incorrect inheritable capability in CAPSET records",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53287",
"datePublished": "2026-06-26T19:40:47.946Z",
"dateReserved": "2026-06-09T07:44:35.396Z",
"dateUpdated": "2026-06-26T19:40:47.946Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53032 (GCVE-0-2026-53032)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-06-24 16:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix NULL deref in map_kptr_match_type for scalar regs
Commit ab6c637ad027 ("bpf: Fix a bpf_kptr_xchg() issue with local
kptr") refactored map_kptr_match_type() to branch on btf_is_kernel()
before checking base_type(). A scalar register stored into a kptr
slot has no btf, so the btf_is_kernel(reg->btf) call dereferences
NULL.
Move the base_type() != PTR_TO_BTF_ID guard before any reg->btf
access.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ab6c637ad0276e42f8acabcbc64932a6d346dab3 Version: ab6c637ad0276e42f8acabcbc64932a6d346dab3 Version: ab6c637ad0276e42f8acabcbc64932a6d346dab3 Version: ab6c637ad0276e42f8acabcbc64932a6d346dab3 Version: ab6c637ad0276e42f8acabcbc64932a6d346dab3 Version: af3d2e0f3a54e67806959d161e613457772babc5 Version: 4782968e0d631b0d8944dcfd4bf8fb49be087101 Version: 6.4.16 ≤ Version: 6.5.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "520454e839710c327808c2fcc98e28cee77355fc",
"status": "affected",
"version": "ab6c637ad0276e42f8acabcbc64932a6d346dab3",
"versionType": "git"
},
{
"lessThan": "0a36c1f72888bca0237295a4da19cd91821a90be",
"status": "affected",
"version": "ab6c637ad0276e42f8acabcbc64932a6d346dab3",
"versionType": "git"
},
{
"lessThan": "6982653ce5f119982aa58f1af58e7bfbebf39252",
"status": "affected",
"version": "ab6c637ad0276e42f8acabcbc64932a6d346dab3",
"versionType": "git"
},
{
"lessThan": "da1d615ce49a47986a8864e2371a26e97861085c",
"status": "affected",
"version": "ab6c637ad0276e42f8acabcbc64932a6d346dab3",
"versionType": "git"
},
{
"lessThan": "4d0a375887ab4d49e4da1ff10f9606cab8f7c3ad",
"status": "affected",
"version": "ab6c637ad0276e42f8acabcbc64932a6d346dab3",
"versionType": "git"
},
{
"status": "affected",
"version": "af3d2e0f3a54e67806959d161e613457772babc5",
"versionType": "git"
},
{
"status": "affected",
"version": "4782968e0d631b0d8944dcfd4bf8fb49be087101",
"versionType": "git"
},
{
"lessThan": "6.5",
"status": "affected",
"version": "6.4.16",
"versionType": "semver"
},
{
"lessThan": "6.6",
"status": "affected",
"version": "6.5.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix NULL deref in map_kptr_match_type for scalar regs\n\nCommit ab6c637ad027 (\"bpf: Fix a bpf_kptr_xchg() issue with local\nkptr\") refactored map_kptr_match_type() to branch on btf_is_kernel()\nbefore checking base_type(). A scalar register stored into a kptr\nslot has no btf, so the btf_is_kernel(reg-\u003ebtf) call dereferences\nNULL.\n\nMove the base_type() != PTR_TO_BTF_ID guard before any reg-\u003ebtf\naccess."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:29:39.916Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/520454e839710c327808c2fcc98e28cee77355fc"
},
{
"url": "https://git.kernel.org/stable/c/0a36c1f72888bca0237295a4da19cd91821a90be"
},
{
"url": "https://git.kernel.org/stable/c/6982653ce5f119982aa58f1af58e7bfbebf39252"
},
{
"url": "https://git.kernel.org/stable/c/da1d615ce49a47986a8864e2371a26e97861085c"
},
{
"url": "https://git.kernel.org/stable/c/4d0a375887ab4d49e4da1ff10f9606cab8f7c3ad"
}
],
"title": "bpf: Fix NULL deref in map_kptr_match_type for scalar regs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53032",
"datePublished": "2026-06-24T16:29:39.916Z",
"dateReserved": "2026-06-09T07:44:35.380Z",
"dateUpdated": "2026-06-24T16:29:39.916Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53082 (GCVE-0-2026-53082)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-06-24 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf
sixpack_receive_buf() does not properly skip bytes with TTY error flags.
The while loop iterates through the flags buffer but never advances the
data pointer (cp), and passes the original count (including error bytes)
to sixpack_decode(). This causes sixpack_decode() to process bytes that
should have been skipped due to TTY errors. The TTY layer does not
guarantee that cp[i] holds a meaningful value when fp[i] is set, so
passing those positions to sixpack_decode() results in KMSAN reporting
an uninit-value read.
Fix this by processing bytes one at a time, advancing cp on each
iteration, and only passing valid (non-error) bytes to sixpack_decode().
This matches the pattern used by slip_receive_buf() and
mkiss_receive_buf() for the same purpose.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/hamradio/6pack.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1d3abf0c3ddeefc6f6d913aa129acc06fce8240a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d4cceb5184538613572fb79319453f281b1eeacb",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2951656b0de00153f2687f3a093890bce72b6215",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e9cf4018d74237d142cd66243c821d13593270f0",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d9ce2a4b679122397d7f35bad7be46913ad1ca80",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "987af7625ceb1ee59d70eb0abd7af11c75e45d79",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "578f3aba427c938fecfa0d8c83d9acb213a9b24a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "bf9a38803b2626b01cc769aaf13485d8650f576f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/hamradio/6pack.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hamradio: 6pack: fix uninit-value in sixpack_receive_buf\n\nsixpack_receive_buf() does not properly skip bytes with TTY error flags.\nThe while loop iterates through the flags buffer but never advances the\ndata pointer (cp), and passes the original count (including error bytes)\nto sixpack_decode(). This causes sixpack_decode() to process bytes that\nshould have been skipped due to TTY errors. The TTY layer does not\nguarantee that cp[i] holds a meaningful value when fp[i] is set, so\npassing those positions to sixpack_decode() results in KMSAN reporting\nan uninit-value read.\n\nFix this by processing bytes one at a time, advancing cp on each\niteration, and only passing valid (non-error) bytes to sixpack_decode().\nThis matches the pattern used by slip_receive_buf() and\nmkiss_receive_buf() for the same purpose."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:22.817Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1d3abf0c3ddeefc6f6d913aa129acc06fce8240a"
},
{
"url": "https://git.kernel.org/stable/c/d4cceb5184538613572fb79319453f281b1eeacb"
},
{
"url": "https://git.kernel.org/stable/c/2951656b0de00153f2687f3a093890bce72b6215"
},
{
"url": "https://git.kernel.org/stable/c/e9cf4018d74237d142cd66243c821d13593270f0"
},
{
"url": "https://git.kernel.org/stable/c/d9ce2a4b679122397d7f35bad7be46913ad1ca80"
},
{
"url": "https://git.kernel.org/stable/c/987af7625ceb1ee59d70eb0abd7af11c75e45d79"
},
{
"url": "https://git.kernel.org/stable/c/578f3aba427c938fecfa0d8c83d9acb213a9b24a"
},
{
"url": "https://git.kernel.org/stable/c/bf9a38803b2626b01cc769aaf13485d8650f576f"
}
],
"title": "net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53082",
"datePublished": "2026-06-24T16:30:22.817Z",
"dateReserved": "2026-06-09T07:44:35.383Z",
"dateUpdated": "2026-06-24T16:30:22.817Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53355 (GCVE-0-2026-53355)
Vulnerability from cvelistv5
Published
2026-07-01 13:32
Modified
2026-08-05 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: rds: clear i_sends on setup unwind
The RDS IB connection teardown path is written so it can run during
partial startup and on repeated shutdown attempts. It uses NULL
pointers to distinguish resources that are still owned from resources
that have already been released.
When rds_ib_setup_qp() fails after allocating i_sends but before
allocating i_recvs, the sends_out path frees i_sends without clearing
the pointer. A later shutdown pass can still treat that stale pointer
as a live send ring allocation.
Clear i_sends after vfree() in the error unwind path so the existing
shutdown logic continues to use the correct ownership state.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3b12f73a5c2977153f28a224392fd4729b50d1dc Version: 3b12f73a5c2977153f28a224392fd4729b50d1dc Version: 3b12f73a5c2977153f28a224392fd4729b50d1dc Version: 3b12f73a5c2977153f28a224392fd4729b50d1dc Version: 3b12f73a5c2977153f28a224392fd4729b50d1dc Version: 3b12f73a5c2977153f28a224392fd4729b50d1dc Version: 3b12f73a5c2977153f28a224392fd4729b50d1dc Version: 3b12f73a5c2977153f28a224392fd4729b50d1dc Version: 75a12b2fa80c2e4cc40a9f9305f95899850b7426 Version: c9459693fae9a1bf3f51f3db98617f694112e897 Version: 13099ee9c7d54b0a25f6c8397675aed99e9cfa45 Version: 5c6712ab4efb6cf60e16719ab6bcaface9cc268c Version: 3.18.74 ≤ Version: 4.1.46 ≤ Version: 4.4.91 ≤ Version: 4.9.54 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/rds/ib_cm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "66cccec111421a10efdc2c74499d15b93e7acae5",
"status": "affected",
"version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
"versionType": "git"
},
{
"lessThan": "2c5e5e4a5970c41f16e3ad801a78719ed5d5c71b",
"status": "affected",
"version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
"versionType": "git"
},
{
"lessThan": "29d940026dce39e3018dab6f67c9427249321270",
"status": "affected",
"version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
"versionType": "git"
},
{
"lessThan": "e7cf30aa5f1fc6c2a86df65df8b731df20e44d79",
"status": "affected",
"version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
"versionType": "git"
},
{
"lessThan": "f16ad421a4e3e7db2d14bdf3b16f583bc4f3b30a",
"status": "affected",
"version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
"versionType": "git"
},
{
"lessThan": "1d4ec754ee3871f7e3670c67bb0298c9c5760926",
"status": "affected",
"version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
"versionType": "git"
},
{
"lessThan": "27040bbca289a704eafcacca167d310c6ce2b1bc",
"status": "affected",
"version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
"versionType": "git"
},
{
"lessThan": "20cf0fb715c41111469577e85e35d15f099473e0",
"status": "affected",
"version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
"versionType": "git"
},
{
"status": "affected",
"version": "75a12b2fa80c2e4cc40a9f9305f95899850b7426",
"versionType": "git"
},
{
"status": "affected",
"version": "c9459693fae9a1bf3f51f3db98617f694112e897",
"versionType": "git"
},
{
"status": "affected",
"version": "13099ee9c7d54b0a25f6c8397675aed99e9cfa45",
"versionType": "git"
},
{
"status": "affected",
"version": "5c6712ab4efb6cf60e16719ab6bcaface9cc268c",
"versionType": "git"
},
{
"lessThan": "3.19",
"status": "affected",
"version": "3.18.74",
"versionType": "semver"
},
{
"lessThan": "4.2",
"status": "affected",
"version": "4.1.46",
"versionType": "semver"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.91",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.54",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/rds/ib_cm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.18.74",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.1.46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.54",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rds: clear i_sends on setup unwind\n\nThe RDS IB connection teardown path is written so it can run during\npartial startup and on repeated shutdown attempts. It uses NULL\npointers to distinguish resources that are still owned from resources\nthat have already been released.\n\nWhen rds_ib_setup_qp() fails after allocating i_sends but before\nallocating i_recvs, the sends_out path frees i_sends without clearing\nthe pointer. A later shutdown pass can still treat that stale pointer\nas a live send ring allocation.\n\nClear i_sends after vfree() in the error unwind path so the existing\nshutdown logic continues to use the correct ownership state."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable RDS/IB setup path is reachable by a remote RDMA/RDS peer through RDMA CM connection requests handled by the kernel listener, before any RDS-level authentication. It is also reachable locally via AF_RDS send-triggered connects, but the remote network path is the higher-severity reasonable scenario.\nAC:L - The bug is triggered when `i_recvs` allocation fails after `i_sends` was allocated, and an attacker can drive repeated connection setup/resource pressure to reach that condition. No race or victim-controlled timing is required.\nPR:N - The incoming RDMA CM connect path requires no local account or authenticated RDS credentials. Local AF_RDS access is unprivileged in the initial network namespace, but the remote path makes privileges none.\nUI:N - No victim user action is needed once the RDS/IB listener is present. Connection setup and teardown are handled by kernel workqueues/CM callbacks.\nS:U - The corruption occurs inside the host kernel RDS/IB connection state and does not cross a separate security authority such as a guest-host or IOMMU boundary. This is standard kernel compromise/DoS scope.\nC:H - The stale `i_sends` pointer creates a use-after-free/double-free of kernel memory and the teardown path reads the freed send ring. Under the required high-severity assumption for UAF-style memory corruption, this can support kernel memory disclosure.\nI:H - The same stale-pointer/double-free condition can corrupt kernel allocator state or operate on attacker-reused freed memory. As kernel memory corruption, it is defensibly scored as capable of arbitrary write/control-flow impact.\nA:H - At minimum, the later shutdown pass can dereference and free an already freed kernel allocation, causing an oops, panic, or allocator corruption. Repeated unauthenticated connection attempts can therefore crash or destabilize the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:35:04.534Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/66cccec111421a10efdc2c74499d15b93e7acae5"
},
{
"url": "https://git.kernel.org/stable/c/2c5e5e4a5970c41f16e3ad801a78719ed5d5c71b"
},
{
"url": "https://git.kernel.org/stable/c/29d940026dce39e3018dab6f67c9427249321270"
},
{
"url": "https://git.kernel.org/stable/c/e7cf30aa5f1fc6c2a86df65df8b731df20e44d79"
},
{
"url": "https://git.kernel.org/stable/c/f16ad421a4e3e7db2d14bdf3b16f583bc4f3b30a"
},
{
"url": "https://git.kernel.org/stable/c/1d4ec754ee3871f7e3670c67bb0298c9c5760926"
},
{
"url": "https://git.kernel.org/stable/c/27040bbca289a704eafcacca167d310c6ce2b1bc"
},
{
"url": "https://git.kernel.org/stable/c/20cf0fb715c41111469577e85e35d15f099473e0"
}
],
"title": "net: rds: clear i_sends on setup unwind",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53355",
"datePublished": "2026-07-01T13:32:30.831Z",
"dateReserved": "2026-06-09T07:44:35.400Z",
"dateUpdated": "2026-08-05T12:35:04.534Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53003 (GCVE-0-2026-53003)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
pppoe: drop PFC frames
RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT
RECOMMENDED for PPPoE. In practice, pppd does not support negotiating
PFC for PPPoE sessions, and the current PPPoE driver assumes an
uncompressed (2-byte) protocol field. However, the generic PPP layer
function ppp_input() is not aware of the negotiation result, and still
accepts PFC frames.
If a peer with a broken implementation or an attacker sends a frame with
a compressed (1-byte) protocol field, the subsequent PPP payload is
shifted by one byte. This causes the network header to be 4-byte
misaligned, which may trigger unaligned access exceptions on some
architectures.
To reduce the attack surface, drop PPPoE PFC frames. Introduce
ppp_skb_is_compressed_proto() helper function to be used in both
ppp_generic.c and pppoe.c to avoid open-coding.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 Version: 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 Version: 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 Version: 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 Version: 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 Version: 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 Version: 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 Version: 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ppp/ppp_generic.c",
"drivers/net/ppp/pppoe.c",
"include/linux/ppp_defs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cb3beef35ab5e0c1afca9fd7648c6ae499786377",
"status": "affected",
"version": "7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6",
"versionType": "git"
},
{
"lessThan": "ba758fdf1399f310b30098b6faa3fd043de47dd2",
"status": "affected",
"version": "7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6",
"versionType": "git"
},
{
"lessThan": "fcca1df05322bb04e344dd1178b54b76a08eb7c3",
"status": "affected",
"version": "7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6",
"versionType": "git"
},
{
"lessThan": "8a5e840babc5c0fbd10c73728a13192347771ec6",
"status": "affected",
"version": "7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6",
"versionType": "git"
},
{
"lessThan": "49e41b60ccd1bdbe9e218420f716dd5f9a2f9c71",
"status": "affected",
"version": "7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6",
"versionType": "git"
},
{
"lessThan": "0cab5d077dd1efd2bd1a47271acc35894f945b4f",
"status": "affected",
"version": "7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6",
"versionType": "git"
},
{
"lessThan": "2b5c3c040d020e3ab3b9a8887031202d96843b1e",
"status": "affected",
"version": "7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6",
"versionType": "git"
},
{
"lessThan": "cc1ff87bce1ccd38410ab10960f576dcd17db679",
"status": "affected",
"version": "7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ppp/ppp_generic.c",
"drivers/net/ppp/pppoe.c",
"include/linux/ppp_defs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npppoe: drop PFC frames\n\nRFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT\nRECOMMENDED for PPPoE. In practice, pppd does not support negotiating\nPFC for PPPoE sessions, and the current PPPoE driver assumes an\nuncompressed (2-byte) protocol field. However, the generic PPP layer\nfunction ppp_input() is not aware of the negotiation result, and still\naccepts PFC frames.\n\nIf a peer with a broken implementation or an attacker sends a frame with\na compressed (1-byte) protocol field, the subsequent PPP payload is\nshifted by one byte. This causes the network header to be 4-byte\nmisaligned, which may trigger unaligned access exceptions on some\narchitectures.\n\nTo reduce the attack surface, drop PPPoE PFC frames. Introduce\nppp_skb_is_compressed_proto() helper function to be used in both\nppp_generic.c and pppoe.c to avoid open-coding."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Crafted PPPoE session frames reach the vulnerable path through the kernel receive path for ETH_P_PPP_SES network packets. A malicious PPPoE peer or network attacker able to send matching session frames can trigger it remotely over the network interface.\nAC:L - The trigger is a single compressed PPP protocol field in an otherwise valid PPPoE session frame, with no race or attacker-uncontrolled timing. On strict-alignment architectures used in plausible PPPoE deployments, the resulting misalignment deterministically reaches fault-prone network-header parsing.\nPR:N - The attacker only needs to transmit crafted PPPoE frames to an existing session and does not need local privileges or authenticated access on the victim. Local CAP_NET_ADMIN may be needed to configure PPPoE, but that is not a privilege required by the packet sender.\nUI:N - No victim interaction is required once the target is running a PPPoE session. The malicious frame is processed asynchronously by the network receive path.\nS:U - The impact is within the kernel/network stack security authority of the vulnerable system. There is no VM, sandbox, or other separate security scope crossed.\nC:N - The bug shifts packet alignment and can cause unaligned access exceptions, but it does not expose kernel memory or provide an information disclosure primitive. The skb push writes within packet headroom and is not an arbitrary read condition.\nI:N - The issue does not provide attacker-controlled modification of kernel memory or data structures. Its demonstrated and intended impact is malformed alignment leading to faulting packet processing, not integrity compromise.\nA:H - Misaligned network headers can trigger unaligned access exceptions and kernel oops/panic on strict-alignment architectures. The crafted frame can be sent repeatedly, making system availability impact high."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:33.280Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cb3beef35ab5e0c1afca9fd7648c6ae499786377"
},
{
"url": "https://git.kernel.org/stable/c/ba758fdf1399f310b30098b6faa3fd043de47dd2"
},
{
"url": "https://git.kernel.org/stable/c/fcca1df05322bb04e344dd1178b54b76a08eb7c3"
},
{
"url": "https://git.kernel.org/stable/c/8a5e840babc5c0fbd10c73728a13192347771ec6"
},
{
"url": "https://git.kernel.org/stable/c/49e41b60ccd1bdbe9e218420f716dd5f9a2f9c71"
},
{
"url": "https://git.kernel.org/stable/c/0cab5d077dd1efd2bd1a47271acc35894f945b4f"
},
{
"url": "https://git.kernel.org/stable/c/2b5c3c040d020e3ab3b9a8887031202d96843b1e"
},
{
"url": "https://git.kernel.org/stable/c/cc1ff87bce1ccd38410ab10960f576dcd17db679"
}
],
"title": "pppoe: drop PFC frames",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53003",
"datePublished": "2026-06-24T16:29:15.268Z",
"dateReserved": "2026-06-09T07:44:35.377Z",
"dateUpdated": "2026-08-05T12:32:33.280Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52972 (GCVE-0-2026-52972)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-08-17 04:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: af_alg - Cap AEAD AD length to 0x80000000
In order to prevent arithmetic overflows when checking the TX
buffer size, cap the associated data length to 0x80000000.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 400c40cf78da00c16e561a3a253ca272455c42ef Version: 400c40cf78da00c16e561a3a253ca272455c42ef Version: 400c40cf78da00c16e561a3a253ca272455c42ef Version: 400c40cf78da00c16e561a3a253ca272455c42ef Version: 400c40cf78da00c16e561a3a253ca272455c42ef Version: 400c40cf78da00c16e561a3a253ca272455c42ef Version: 400c40cf78da00c16e561a3a253ca272455c42ef Version: 400c40cf78da00c16e561a3a253ca272455c42ef Version: 400c40cf78da00c16e561a3a253ca272455c42ef |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s `af_alg` cryptography module. This vulnerability involves an arithmetic overflow when processing associated data lengths during the transmit buffer size check. A remote attacker could exploit this flaw by providing a specially crafted associated data length, potentially leading to a denial of service (DoS) due to system instability."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T02:46:50.271Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-52972"
},
{
"name": "RHBZ#2492364",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492364"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52972.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"crypto/af_alg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f8a5203596797f394ff3f9aa4005597a92249802",
"status": "affected",
"version": "400c40cf78da00c16e561a3a253ca272455c42ef",
"versionType": "git"
},
{
"lessThan": "a9f68d9ed38dd6e5a6c6d75b03d25c1c133e321d",
"status": "affected",
"version": "400c40cf78da00c16e561a3a253ca272455c42ef",
"versionType": "git"
},
{
"lessThan": "a4fe4eb580bbc7439f649a496d4cf38415a4021c",
"status": "affected",
"version": "400c40cf78da00c16e561a3a253ca272455c42ef",
"versionType": "git"
},
{
"lessThan": "e4c4a5074532eaaa14951994a3aad0d479aa7431",
"status": "affected",
"version": "400c40cf78da00c16e561a3a253ca272455c42ef",
"versionType": "git"
},
{
"lessThan": "265ac26d1c5e17b34d497cbda1f754a1ec8552bc",
"status": "affected",
"version": "400c40cf78da00c16e561a3a253ca272455c42ef",
"versionType": "git"
},
{
"lessThan": "a1c5672faf8e93e38c2deac3979cc767ca5cf918",
"status": "affected",
"version": "400c40cf78da00c16e561a3a253ca272455c42ef",
"versionType": "git"
},
{
"lessThan": "97948906dc8e0ea84775e03e35b60a2063c70193",
"status": "affected",
"version": "400c40cf78da00c16e561a3a253ca272455c42ef",
"versionType": "git"
},
{
"lessThan": "0b3a57d218618cb1cc78ddc9ba02c07de84b46f4",
"status": "affected",
"version": "400c40cf78da00c16e561a3a253ca272455c42ef",
"versionType": "git"
},
{
"lessThan": "e4c06479d7059888adf2f22bc1ebcf053bf691a2",
"status": "affected",
"version": "400c40cf78da00c16e561a3a253ca272455c42ef",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"crypto/af_alg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Cap AEAD AD length to 0x80000000\n\nIn order to prevent arithmetic overflows when checking the TX\nbuffer size, cap the associated data length to 0x80000000."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:50:24.931Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f8a5203596797f394ff3f9aa4005597a92249802"
},
{
"url": "https://git.kernel.org/stable/c/a9f68d9ed38dd6e5a6c6d75b03d25c1c133e321d"
},
{
"url": "https://git.kernel.org/stable/c/a4fe4eb580bbc7439f649a496d4cf38415a4021c"
},
{
"url": "https://git.kernel.org/stable/c/e4c4a5074532eaaa14951994a3aad0d479aa7431"
},
{
"url": "https://git.kernel.org/stable/c/265ac26d1c5e17b34d497cbda1f754a1ec8552bc"
},
{
"url": "https://git.kernel.org/stable/c/a1c5672faf8e93e38c2deac3979cc767ca5cf918"
},
{
"url": "https://git.kernel.org/stable/c/97948906dc8e0ea84775e03e35b60a2063c70193"
},
{
"url": "https://git.kernel.org/stable/c/0b3a57d218618cb1cc78ddc9ba02c07de84b46f4"
},
{
"url": "https://git.kernel.org/stable/c/e4c06479d7059888adf2f22bc1ebcf053bf691a2"
}
],
"title": "crypto: af_alg - Cap AEAD AD length to 0x80000000",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52972",
"datePublished": "2026-06-24T16:28:50.425Z",
"dateReserved": "2026-06-09T07:44:35.375Z",
"dateUpdated": "2026-08-17T04:50:24.931Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50721 (GCVE-0-2026-50721)
Vulnerability from cvelistv5
Published
2026-07-02 21:44
Modified
2026-07-07 17:01
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
VLAI Severity ?
EPSS score ?
Summary
Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the SIG payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of remote IKE peers are not affected.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| The Libreswan Project | libreswan |
Version: 0 ≤ 5.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50721",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-06T18:12:17.199605Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-07T17:01:58.011Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/libreswan/libreswan",
"defaultStatus": "unaffected",
"packageName": "libreswan",
"product": "libreswan",
"programRoutines": [
{
"name": "RSA_authenticate_hash_signature_raw_rsa"
}
],
"repo": "https://github.com/libreswan/libreswan",
"vendor": "The Libreswan Project",
"versions": [
{
"lessThanOrEqual": "5.3",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.3.1",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "Any server or client that accepts RSA-based IKEv1 connections via the default authby=rsasig option is vulnerable to denial of service. Authentication bypass additionally requires the use of RSA keys with weak exponents (e=3). IKEv1 only supports RSA-SHA1 (PKCS#1 Version 1.5) for public key authentication, so the vulnerable code path cannot be disabled without migrating to IKEv2 or switching to PSK."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yeonghyeon Choi"
},
{
"lang": "en",
"type": "finder",
"value": "Duyeong Kim"
},
{
"lang": "en",
"type": "analyst",
"value": "Andrew Cagney (The Libreswan Team)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eLibreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the SIG payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of remote IKE peers are not affected.\u003c/p\u003e"
}
],
"value": "Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the SIG payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of remote IKE peers are not affected."
}
],
"exploits": [
{
"lang": "en",
"value": "No known exploitation in the wild. The authentication bypass requires the target to use RSA keys with weak exponents (e=3), which have been disallowed by most cryptographic libraries for at least a decade. The denial-of-service attack is exploitable against any IKEv1 configuration using the default authby=rsasig option."
}
],
"impacts": [
{
"capecId": "CAPEC-463",
"descriptions": [
{
"lang": "en",
"value": "Denial of Service via assertion failure in pluto daemon when processing malformed RSA PKCS#1 v1.5 SIG payloads in IKEv1"
}
]
},
{
"capecId": "CAPEC-473",
"descriptions": [
{
"lang": "en",
"value": "Authentication bypass via Bleichenbacher-style signature forgery when weak RSA exponents (e.g., e=3) are in use"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Weak RSA exponent (e=3) in use, enabling Bleichenbacher signature forgery"
}
]
},
{
"other": {
"content": {
"description": "Vendor-assessed severity: Medium. Authentication bypass requires weak RSA exponents (e=3) which have been disallowed by most cryptographic libraries for over a decade. DoS is mitigated by automatic daemon restart.",
"value": "MEDIUM"
},
"type": "vendorSeverity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347: Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-617",
"description": "CWE-617: Reachable Assertion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-02T21:44:09.423Z",
"orgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
"shortName": "libreswan"
},
"references": [
{
"name": "Libreswan Security Advisory CVE-2026-50721",
"tags": [
"vendor-advisory"
],
"url": "https://libreswan.org/security/CVE-2026-50721/CVE-2026-50721.txt"
},
{
"name": "Libreswan CVE-2026-50721 Patches",
"tags": [
"patch"
],
"url": "https://libreswan.org/security/CVE-2026-50721/"
},
{
"name": "Related: CVE-2026-50722 (IKEv2 variant)",
"tags": [
"related"
],
"url": "https://libreswan.org/security/CVE-2026-50722/CVE-2026-50722.txt"
},
{
"name": "RFC 2313 - PKCS #1: RSA Encryption Version 1.5",
"tags": [
"technical-description"
],
"url": "https://www.rfc-editor.org/rfc/rfc2313"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to libreswan 5.3.1 or later. Patches for libreswan 4.15 and 5.3 are available at \u003ca href=\"https://libreswan.org/security/CVE-2026-50721/\"\u003ehttps://libreswan.org/security/CVE-2026-50721/\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "Upgrade to libreswan 5.3.1 or later. Patches for libreswan 4.15 and 5.3 are available at https://libreswan.org/security/CVE-2026-50721/"
}
],
"source": {
"defects": [
"CVE-2026-50721"
],
"discovery": "EXTERNAL"
},
"taxonomyMappings": [
{
"taxonomyName": "ATT\u0026CK",
"taxonomyRelations": [
{
"relationshipName": "maps to",
"relationshipValue": "Application or System Exploitation (DoS)",
"taxonomyId": "T1499.004"
}
],
"taxonomyVersion": "15.1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-24T00:00:00.000Z",
"value": "Libreswan notified of the issue via security@libreswan.org"
},
{
"lang": "en",
"time": "2026-06-16T00:00:00.000Z",
"value": "Advanced notice given to supported customers and distributions"
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Public announcement and release of libreswan 5.3.1"
}
],
"title": "IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIKEv1 only supports RSA-SHA1 (PKCS#1 Version 1.5) with public key authentication, so there is no way to disable the vulnerable code path within IKEv1. Migrate IKEv1 connections to IKEv2 where \u003ccode\u003eauthby=ecdsa\u003c/code\u003e or \u003ccode\u003eauthby=rsa-sha2\u003c/code\u003e can be configured. For static tunnel configurations (not Remote Access VPN Client groups), authentication can be changed to use PSK via \u003ccode\u003eauthby=secret\u003c/code\u003e after coordination with the remote peer.\u003c/p\u003e"
}
],
"value": "IKEv1 only supports RSA-SHA1 (PKCS#1 Version 1.5) with public key authentication, so there is no way to disable the vulnerable code path within IKEv1. Migrate IKEv1 connections to IKEv2 where authby=ecdsa or authby=rsa-sha2 can be configured. For static tunnel configurations (not Remote Access VPN Client groups), authentication can be changed to use PSK via authby=secret after coordination with the remote peer."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
"assignerShortName": "libreswan",
"cveId": "CVE-2026-50721",
"datePublished": "2026-07-02T21:44:09.423Z",
"dateReserved": "2026-06-05T16:10:05.751Z",
"dateUpdated": "2026-07-07T17:01:58.011Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53021 (GCVE-0-2026-53021)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-06-24 16:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: core: Fix integer overflow in UNMAP bounds check
sbc_execute_unmap() checks LBA + range does not exceed the device capacity,
but does not guard against LBA + range wrapping around on 64-bit overflow.
Add an overflow check matching the pattern already used for WRITE_SAME in
the same file.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 86d7182985d25900929adce14fffd729cc8c6fb8 Version: 86d7182985d25900929adce14fffd729cc8c6fb8 Version: 86d7182985d25900929adce14fffd729cc8c6fb8 Version: 86d7182985d25900929adce14fffd729cc8c6fb8 Version: 86d7182985d25900929adce14fffd729cc8c6fb8 Version: 86d7182985d25900929adce14fffd729cc8c6fb8 Version: 86d7182985d25900929adce14fffd729cc8c6fb8 Version: 86d7182985d25900929adce14fffd729cc8c6fb8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/target/target_core_sbc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c08ab702c4699c6efb9d60bdb15b73e7a627ee7e",
"status": "affected",
"version": "86d7182985d25900929adce14fffd729cc8c6fb8",
"versionType": "git"
},
{
"lessThan": "2e1ed9a7b6ea5bfefb5d80a02b1c71c7dee1f0dd",
"status": "affected",
"version": "86d7182985d25900929adce14fffd729cc8c6fb8",
"versionType": "git"
},
{
"lessThan": "5efc3ef4758f8d98c257419fa21daca3227de61a",
"status": "affected",
"version": "86d7182985d25900929adce14fffd729cc8c6fb8",
"versionType": "git"
},
{
"lessThan": "d7aef29573c7c5cdb2dfad939253287a6329c2a4",
"status": "affected",
"version": "86d7182985d25900929adce14fffd729cc8c6fb8",
"versionType": "git"
},
{
"lessThan": "3facdecc3fcf115cc4f9b3d8f118d6705e2456a8",
"status": "affected",
"version": "86d7182985d25900929adce14fffd729cc8c6fb8",
"versionType": "git"
},
{
"lessThan": "51075df70c46e60a9773f2dcd28299e40dac36fb",
"status": "affected",
"version": "86d7182985d25900929adce14fffd729cc8c6fb8",
"versionType": "git"
},
{
"lessThan": "02115986d027ade793e7f6be87e91d6a796d0aa3",
"status": "affected",
"version": "86d7182985d25900929adce14fffd729cc8c6fb8",
"versionType": "git"
},
{
"lessThan": "2bf2d65f76697820dbc4227d13866293576dd90a",
"status": "affected",
"version": "86d7182985d25900929adce14fffd729cc8c6fb8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/target/target_core_sbc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: core: Fix integer overflow in UNMAP bounds check\n\nsbc_execute_unmap() checks LBA + range does not exceed the device capacity,\nbut does not guard against LBA + range wrapping around on 64-bit overflow.\n\nAdd an overflow check matching the pattern already used for WRITE_SAME in\nthe same file."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:29:30.671Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c08ab702c4699c6efb9d60bdb15b73e7a627ee7e"
},
{
"url": "https://git.kernel.org/stable/c/2e1ed9a7b6ea5bfefb5d80a02b1c71c7dee1f0dd"
},
{
"url": "https://git.kernel.org/stable/c/5efc3ef4758f8d98c257419fa21daca3227de61a"
},
{
"url": "https://git.kernel.org/stable/c/d7aef29573c7c5cdb2dfad939253287a6329c2a4"
},
{
"url": "https://git.kernel.org/stable/c/3facdecc3fcf115cc4f9b3d8f118d6705e2456a8"
},
{
"url": "https://git.kernel.org/stable/c/51075df70c46e60a9773f2dcd28299e40dac36fb"
},
{
"url": "https://git.kernel.org/stable/c/02115986d027ade793e7f6be87e91d6a796d0aa3"
},
{
"url": "https://git.kernel.org/stable/c/2bf2d65f76697820dbc4227d13866293576dd90a"
}
],
"title": "scsi: target: core: Fix integer overflow in UNMAP bounds check",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53021",
"datePublished": "2026-06-24T16:29:30.671Z",
"dateReserved": "2026-06-09T07:44:35.379Z",
"dateUpdated": "2026-06-24T16:29:30.671Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52989 (GCVE-0-2026-52989)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-08-24 12:07
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds
PDU length or offset, it triggers nvmet_tcp_fatal_error(cmd->queue)
and returns early. However, because the function returns void, the
callers are entirely unaware that a fatal error has occurred and
that the cmd->recv_msg.msg_iter was left uninitialized.
Callers such as nvmet_tcp_handle_h2c_data_pdu() proceed to blindly
overwrite the queue state with queue->rcv_state = NVMET_TCP_RECV_DATA
Consequently, the socket receiving loop may attempt to read incoming
network data into the uninitialized iterator.
Fix this by shifting the error handling responsibility to the callers.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1385be357e8acd09b36e026567f3a9d5c61139de Version: dca1a6ba0da9f472ef040525fab10fd9956db59f Version: 19672ae68d52ff75347ebe2420dde1b07adca09f Version: ab200d71553bdcf4de554a5985b05b2dd606bc57 Version: 52a0a98549344ca20ad81a4176d68d28e3c05a5c Version: 52a0a98549344ca20ad81a4176d68d28e3c05a5c Version: 043b4307a99f902697349128fde93b2ddde4686c Version: 42afe8ed8ad2de9c19457156244ef3e1eca94b5d Version: 6.1.163 ≤ Version: 6.6.124 ≤ Version: 6.12.70 ≤ Version: 6.18.10 ≤ Version: 5.10.250 ≤ Version: 5.15.200 ≤ |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the `nvmet-tcp` component of the Linux kernel. The `nvmet_tcp_build_pdu_iovec()` function fails to propagate errors when detecting out-of-bounds PDU lengths or offsets. This can lead to uninitialized memory being used by subsequent operations, such as reading incoming network data into an uninitialized iterator. A remote attacker could potentially exploit this memory corruption to cause a denial of service or achieve arbitrary code execution."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-390",
"description": "Detection of Error Condition Without Action",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T12:07:11.778Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-52989"
},
{
"name": "RHBZ#2492443",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492443"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52989.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers",
"workarounds": [
{
"lang": "en",
"value": "For Red Hat Enterprise Linux, mitigation for this issue is not applicable as the product is not affected.\n\nFor Red Hat In-Vehicle OS, if the NVM Express over TCP (nvmet-tcp) functionality is not required, the `nvmet_tcp` kernel module can be prevented from loading. To do this, create a file named `/etc/modprobe.d/disable-nvmet-tcp.conf` with the following content:\n`install nvmet_tcp /bin/true`\n`blacklist nvmet_tcp`\nAfter creating the file, regenerate the initramfs and reboot the system for the changes to take effect. Disabling this module may impact storage functionality if NVMe over TCP is in use."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3df42a854686fa06484e37ac1a3931c8e3e3453c",
"status": "affected",
"version": "1385be357e8acd09b36e026567f3a9d5c61139de",
"versionType": "git"
},
{
"lessThan": "d7c8f95f599b3b38a717d2e771c3f8c174f657c3",
"status": "affected",
"version": "dca1a6ba0da9f472ef040525fab10fd9956db59f",
"versionType": "git"
},
{
"lessThan": "f9204a2b78dd18374d3bcf9bf93d9021ce22de1b",
"status": "affected",
"version": "19672ae68d52ff75347ebe2420dde1b07adca09f",
"versionType": "git"
},
{
"lessThan": "c2a11441538bdbbc5aa003f190995eba93a89b88",
"status": "affected",
"version": "ab200d71553bdcf4de554a5985b05b2dd606bc57",
"versionType": "git"
},
{
"lessThan": "046fa5c72d15cd8e2d592e275697ea399d8f76b0",
"status": "affected",
"version": "52a0a98549344ca20ad81a4176d68d28e3c05a5c",
"versionType": "git"
},
{
"lessThan": "ea8e356acb165cb1fd75537a52e1f66e5e76c538",
"status": "affected",
"version": "52a0a98549344ca20ad81a4176d68d28e3c05a5c",
"versionType": "git"
},
{
"status": "affected",
"version": "043b4307a99f902697349128fde93b2ddde4686c",
"versionType": "git"
},
{
"status": "affected",
"version": "42afe8ed8ad2de9c19457156244ef3e1eca94b5d",
"versionType": "git"
},
{
"lessThan": "6.1.175",
"status": "affected",
"version": "6.1.163",
"versionType": "semver"
},
{
"lessThan": "6.6.141",
"status": "affected",
"version": "6.6.124",
"versionType": "semver"
},
{
"lessThan": "6.12.91",
"status": "affected",
"version": "6.12.70",
"versionType": "semver"
},
{
"lessThan": "6.18.33",
"status": "affected",
"version": "6.18.10",
"versionType": "semver"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.250",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.200",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"lessThan": "6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1.163",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "6.6.124",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.12.70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.18.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.250",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.200",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers\n\nCurrently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds\nPDU length or offset, it triggers nvmet_tcp_fatal_error(cmd-\u003equeue)\nand returns early. However, because the function returns void, the\ncallers are entirely unaware that a fatal error has occurred and\nthat the cmd-\u003erecv_msg.msg_iter was left uninitialized.\n\nCallers such as nvmet_tcp_handle_h2c_data_pdu() proceed to blindly\noverwrite the queue state with queue-\u003ercv_state = NVMET_TCP_RECV_DATA\nConsequently, the socket receiving loop may attempt to read incoming\nnetwork data into the uninitialized iterator.\n\nFix this by shifting the error handling responsibility to the callers."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - nvmet-tcp is a network-facing NVMe-over-TCP target transport, and the vulnerable path is reached by sending crafted NVMe/TCP PDUs over an accepted TCP connection.\nAC:L - The attacker controls the NVMe/TCP command and H2CData PDU lengths/offsets needed to make nvmet_tcp_build_pdu_iovec() fail; no race or hard-to-influence condition is required.\nPR:N - In a reasonable deployment without DH-HMAC-CHAP/TLS enforcement, a remote initiator can connect and send the crafted sequence without prior privileges, and host NQN based admission is not a strong privilege boundary.\nUI:N - No victim action is required after the nvmet-tcp service is listening; exploitation is driven entirely by network traffic from the attacker.\nS:U - The impact is within the vulnerable kernel/NVMe target security authority and does not cross a separate scope such as guest-to-host or IOMMU isolation.\nC:H - The bug can cause attacker-controlled network data to be received through an uninitialized or stale kernel iterator, creating memory corruption that is plausibly usable to disclose kernel or target memory.\nI:H - The stale destination iterator can turn received network data into a kernel memory write primitive, making arbitrary corruption or code execution defensible.\nA:H - Even without full exploitation, the invalid receive through an uninitialized/stale iterator can trigger kernel oops, GPF/KASAN failures, or panic, causing high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:25.683Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3df42a854686fa06484e37ac1a3931c8e3e3453c"
},
{
"url": "https://git.kernel.org/stable/c/d7c8f95f599b3b38a717d2e771c3f8c174f657c3"
},
{
"url": "https://git.kernel.org/stable/c/f9204a2b78dd18374d3bcf9bf93d9021ce22de1b"
},
{
"url": "https://git.kernel.org/stable/c/c2a11441538bdbbc5aa003f190995eba93a89b88"
},
{
"url": "https://git.kernel.org/stable/c/046fa5c72d15cd8e2d592e275697ea399d8f76b0"
},
{
"url": "https://git.kernel.org/stable/c/ea8e356acb165cb1fd75537a52e1f66e5e76c538"
}
],
"title": "nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52989",
"datePublished": "2026-06-24T16:29:03.398Z",
"dateReserved": "2026-06-09T07:44:35.376Z",
"dateUpdated": "2026-08-24T12:07:11.778Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53060 (GCVE-0-2026-53060)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-06-24 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm cache metadata: fix memory leak on metadata abort retry
When failing to acquire the root_lock in dm_cache_metadata_abort because
the block_manager is read-only, the temporary block_manager created
outside the root_lock is not properly released, causing a memory leak.
Reproduce steps:
This can be reproduced by reloading a new table while the metadata
is read-only. While the second call to dm_cache_metadata_abort is
caused by lack of support for table preload in dm-cache, mentioned
in commit 9b1cc9f251af ("dm cache: share cache-metadata object across
inactive and active DM tables"), it exposes the memory leak in
dm_cache_metadata_abort when the function is called multiple times.
Specifically, dm-cache fails to sync the new cache object's mode during
preresume, creating the reproducer condition.
This issue could also occur through concurrent metadata_operation_failed
calls due to races in cache mode updates, but the table preload scenario
below provides a reliable reproducer.
1. Create a cache device with some faulty trailing metadata blocks
dmsetup create cmeta <<EOF
0 200 linear /dev/sdc 0
200 7992 error
EOF
dmsetup create cdata --table "0 131072 linear /dev/sdc 8192"
dmsetup create corig --table "0 262144 linear /dev/sdc 262144"
dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct
dmsetup create cache --table "0 131072 cache /dev/mapper/cmeta \
/dev/mapper/cdata /dev/mapper/corig 128 1 writethrough smq 0"
2. Suspend and resume the cache to start a new metadata transaction and
trigger metadata io errors on the next metadata commit.
dmsetup suspend cache
dmsetup resume cache
3. Write to the cache device to update metadata
fio --filename=/dev/mapper/cache --name test --rw=randwrite --bs=4k \
--randrepeat=0 --direct=1 --size 64k
4. Preload the same table
dmsetup reload cache --table "$(dmsetup table cache)"
5. Resume the new table. This triggers the memory leak.
dmsetup suspend cache
dmsetup resume cache
kmemleak logs:
<snip>
unreferenced object 0xffff8880080c2010 (size 16):
comm "dmsetup", pid 132, jiffies 4294982580
hex dump (first 16 bytes):
00 38 b9 07 80 88 ff ff 6a 6b 6b 6b 6b 6b 6b a5 ...
backtrace (crc 3118f31c):
kmemleak_alloc+0x28/0x40
__kmalloc_cache_noprof+0x3d9/0x510
dm_block_manager_create+0x51/0x140
dm_cache_metadata_abort+0x85/0x320
metadata_operation_failed+0x103/0x1e0
cache_preresume+0xacd/0xe70
dm_table_resume_targets+0xd3/0x320
__dm_resume+0x1b/0xf0
dm_resume+0x127/0x170
<snip>
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b45e77b79215405bd039a690f5b06cc03e8ed27d Version: 28d307f380df88a598bc0186d527462902d9bda1 Version: f74b7c5a85e22cd9091845e0d62a1dd89d0f855f Version: 352b837a5541690d4f843819028cf2b8be83d424 Version: 352b837a5541690d4f843819028cf2b8be83d424 Version: 352b837a5541690d4f843819028cf2b8be83d424 Version: 352b837a5541690d4f843819028cf2b8be83d424 Version: 352b837a5541690d4f843819028cf2b8be83d424 Version: 6e237cacda8b4e976849e7bff9fe7dff0e968586 Version: 3972ae47d0ee9b5b434af5d0cca6cdfd1e239d4f Version: 9958f5ffc44530b650fb4cc9038a4d167fa4f5c1 Version: f472bfc95d9c9653172dbdad39219b32fabf9b92 Version: bdd4e106929ac943f3226d8f03754b480701e97b Version: 5.10.163 ≤ Version: 5.15.87 ≤ Version: 6.1.4 ≤ Version: 4.9.337 ≤ Version: 4.14.303 ≤ Version: 4.19.270 ≤ Version: 5.4.229 ≤ Version: 6.0.18 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-cache-metadata.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "14f60e957f34f95a626caec76a8fae88cf4c397f",
"status": "affected",
"version": "b45e77b79215405bd039a690f5b06cc03e8ed27d",
"versionType": "git"
},
{
"lessThan": "6b97cc7a42905755c56bbddc33aa8b792205caee",
"status": "affected",
"version": "28d307f380df88a598bc0186d527462902d9bda1",
"versionType": "git"
},
{
"lessThan": "d1a79620c419a0af1911f99c873014b30740e303",
"status": "affected",
"version": "f74b7c5a85e22cd9091845e0d62a1dd89d0f855f",
"versionType": "git"
},
{
"lessThan": "15c30997dca681f90dbf2d45ee629c1828bf0c0d",
"status": "affected",
"version": "352b837a5541690d4f843819028cf2b8be83d424",
"versionType": "git"
},
{
"lessThan": "b0bd35535bdb6f58505f3a30ee5793986943997a",
"status": "affected",
"version": "352b837a5541690d4f843819028cf2b8be83d424",
"versionType": "git"
},
{
"lessThan": "322a3b70368d49e39591fe9fc6c07d262128b05f",
"status": "affected",
"version": "352b837a5541690d4f843819028cf2b8be83d424",
"versionType": "git"
},
{
"lessThan": "4311ca59a1891d33c4c8b7946f98c34f167fe833",
"status": "affected",
"version": "352b837a5541690d4f843819028cf2b8be83d424",
"versionType": "git"
},
{
"lessThan": "044ca491d4086dc5bf233e9fcb71db52df32f633",
"status": "affected",
"version": "352b837a5541690d4f843819028cf2b8be83d424",
"versionType": "git"
},
{
"status": "affected",
"version": "6e237cacda8b4e976849e7bff9fe7dff0e968586",
"versionType": "git"
},
{
"status": "affected",
"version": "3972ae47d0ee9b5b434af5d0cca6cdfd1e239d4f",
"versionType": "git"
},
{
"status": "affected",
"version": "9958f5ffc44530b650fb4cc9038a4d167fa4f5c1",
"versionType": "git"
},
{
"status": "affected",
"version": "f472bfc95d9c9653172dbdad39219b32fabf9b92",
"versionType": "git"
},
{
"status": "affected",
"version": "bdd4e106929ac943f3226d8f03754b480701e97b",
"versionType": "git"
},
{
"lessThan": "5.10.258",
"status": "affected",
"version": "5.10.163",
"versionType": "semver"
},
{
"lessThan": "5.15.209",
"status": "affected",
"version": "5.15.87",
"versionType": "semver"
},
{
"lessThan": "6.1.175",
"status": "affected",
"version": "6.1.4",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.337",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.303",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.270",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.229",
"versionType": "semver"
},
{
"lessThan": "6.1",
"status": "affected",
"version": "6.0.18",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-cache-metadata.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.10.163",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.15.87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.337",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.303",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.270",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.229",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.0.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm cache metadata: fix memory leak on metadata abort retry\n\nWhen failing to acquire the root_lock in dm_cache_metadata_abort because\nthe block_manager is read-only, the temporary block_manager created\noutside the root_lock is not properly released, causing a memory leak.\n\nReproduce steps:\n\nThis can be reproduced by reloading a new table while the metadata\nis read-only. While the second call to dm_cache_metadata_abort is\ncaused by lack of support for table preload in dm-cache, mentioned\nin commit 9b1cc9f251af (\"dm cache: share cache-metadata object across\ninactive and active DM tables\"), it exposes the memory leak in\ndm_cache_metadata_abort when the function is called multiple times.\nSpecifically, dm-cache fails to sync the new cache object\u0027s mode during\npreresume, creating the reproducer condition.\n\nThis issue could also occur through concurrent metadata_operation_failed\ncalls due to races in cache mode updates, but the table preload scenario\nbelow provides a reliable reproducer.\n\n1. Create a cache device with some faulty trailing metadata blocks\n\ndmsetup create cmeta \u003c\u003cEOF\n0 200 linear /dev/sdc 0\n200 7992 error\nEOF\ndmsetup create cdata --table \"0 131072 linear /dev/sdc 8192\"\ndmsetup create corig --table \"0 262144 linear /dev/sdc 262144\"\ndd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct\ndmsetup create cache --table \"0 131072 cache /dev/mapper/cmeta \\\n/dev/mapper/cdata /dev/mapper/corig 128 1 writethrough smq 0\"\n\n2. Suspend and resume the cache to start a new metadata transaction and\n trigger metadata io errors on the next metadata commit.\n\ndmsetup suspend cache\ndmsetup resume cache\n\n3. Write to the cache device to update metadata\n\nfio --filename=/dev/mapper/cache --name test --rw=randwrite --bs=4k \\\n--randrepeat=0 --direct=1 --size 64k\n\n4. Preload the same table\n\ndmsetup reload cache --table \"$(dmsetup table cache)\"\n\n5. Resume the new table. This triggers the memory leak.\n\ndmsetup suspend cache\ndmsetup resume cache\n\nkmemleak logs:\n\n\u003csnip\u003e\nunreferenced object 0xffff8880080c2010 (size 16):\n comm \"dmsetup\", pid 132, jiffies 4294982580\n hex dump (first 16 bytes):\n 00 38 b9 07 80 88 ff ff 6a 6b 6b 6b 6b 6b 6b a5 ...\n backtrace (crc 3118f31c):\n kmemleak_alloc+0x28/0x40\n __kmalloc_cache_noprof+0x3d9/0x510\n dm_block_manager_create+0x51/0x140\n dm_cache_metadata_abort+0x85/0x320\n metadata_operation_failed+0x103/0x1e0\n cache_preresume+0xacd/0xe70\n dm_table_resume_targets+0xd3/0x320\n __dm_resume+0x1b/0xf0\n dm_resume+0x127/0x170\n\u003csnip\u003e"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:04.872Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/14f60e957f34f95a626caec76a8fae88cf4c397f"
},
{
"url": "https://git.kernel.org/stable/c/6b97cc7a42905755c56bbddc33aa8b792205caee"
},
{
"url": "https://git.kernel.org/stable/c/d1a79620c419a0af1911f99c873014b30740e303"
},
{
"url": "https://git.kernel.org/stable/c/15c30997dca681f90dbf2d45ee629c1828bf0c0d"
},
{
"url": "https://git.kernel.org/stable/c/b0bd35535bdb6f58505f3a30ee5793986943997a"
},
{
"url": "https://git.kernel.org/stable/c/322a3b70368d49e39591fe9fc6c07d262128b05f"
},
{
"url": "https://git.kernel.org/stable/c/4311ca59a1891d33c4c8b7946f98c34f167fe833"
},
{
"url": "https://git.kernel.org/stable/c/044ca491d4086dc5bf233e9fcb71db52df32f633"
}
],
"title": "dm cache metadata: fix memory leak on metadata abort retry",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53060",
"datePublished": "2026-06-24T16:30:04.872Z",
"dateReserved": "2026-06-09T07:44:35.382Z",
"dateUpdated": "2026-06-24T16:30:04.872Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52982 (GCVE-0-2026-52982)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
syzbot reported a KASAN slab-use-after-free read in rtl8150_start_xmit()
when accessing skb->len for tx statistics after usb_submit_urb() has
been called:
BUG: KASAN: slab-use-after-free in rtl8150_start_xmit+0x71f/0x760
drivers/net/usb/rtl8150.c:712
Read of size 4 at addr ffff88810eb7a930 by task kworker/0:4/5226
The URB completion handler write_bulk_callback() frees the skb via
dev_kfree_skb_irq(dev->tx_skb). The URB may complete on another CPU
in softirq context before usb_submit_urb() returns in the submitter,
so by the time the submitter reads skb->len the skb has already been
queued to the per-CPU completion_queue and freed by net_tx_action():
CPU A (xmit) CPU B (USB completion softirq)
------------ ------------------------------
dev->tx_skb = skb;
usb_submit_urb() --+
|-------> write_bulk_callback()
| dev_kfree_skb_irq(dev->tx_skb)
| net_tx_action()
| napi_skb_cache_put() <-- free
netdev->stats.tx_bytes |
+= skb->len; <-- UAF read
Fix it by caching skb->len before submitting the URB and using the
cached value when updating the tx_bytes counter.
The pre-existing tx_bytes semantics are preserved: the counter tracks
the original frame length (skb->len), not the ETH_ZLEN/USB-alignment
padded "count" value that is handed to the device. Changing that
would be a user-visible accounting change and is out of scope for
this UAF fix.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/usb/rtl8150.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5af290c86fa81ddbc86a08d54229af5daa40c6a4",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "24831b0b2ada9fef18d1f486b7b7c444ee5ba637",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "423b5b86e14e190f6e3161eb5f2ea5f908295ba7",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5db090ca07b28a63fb1499690cf19a3f3adafacb",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "30cf9829d09ca958279c937af8e35495cd2f1e09",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6999d70e0eda39af029fa1891c48f0a8832b09d5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "4dd7eb94f79486b77ca6b4c8676aedbc465dc802",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "23f0e34c64acba15cad4d23e50f41f533da195fa",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/usb/rtl8150.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()\n\nsyzbot reported a KASAN slab-use-after-free read in rtl8150_start_xmit()\nwhen accessing skb-\u003elen for tx statistics after usb_submit_urb() has\nbeen called:\n\n BUG: KASAN: slab-use-after-free in rtl8150_start_xmit+0x71f/0x760\n drivers/net/usb/rtl8150.c:712\n Read of size 4 at addr ffff88810eb7a930 by task kworker/0:4/5226\n\nThe URB completion handler write_bulk_callback() frees the skb via\ndev_kfree_skb_irq(dev-\u003etx_skb). The URB may complete on another CPU\nin softirq context before usb_submit_urb() returns in the submitter,\nso by the time the submitter reads skb-\u003elen the skb has already been\nqueued to the per-CPU completion_queue and freed by net_tx_action():\n\n CPU A (xmit) CPU B (USB completion softirq)\n ------------ ------------------------------\n dev-\u003etx_skb = skb;\n usb_submit_urb() --+\n |-------\u003e write_bulk_callback()\n | dev_kfree_skb_irq(dev-\u003etx_skb)\n | net_tx_action()\n | napi_skb_cache_put() \u003c-- free\n netdev-\u003estats.tx_bytes |\n += skb-\u003elen; \u003c-- UAF read\n\nFix it by caching skb-\u003elen before submitting the URB and using the\ncached value when updating the tx_bytes counter.\n\nThe pre-existing tx_bytes semantics are preserved: the counter tracks\nthe original frame length (skb-\u003elen), not the ETH_ZLEN/USB-alignment\npadded \"count\" value that is handed to the device. Changing that\nwould be a user-visible accounting change and is out of scope for\nthis UAF fix."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A remote peer can cause the host to transmit packets through an affected rtl8150 interface via normal network responses such as ICMP replies or TCP resets/ACKs, reaching rtl8150_start_xmit(). Choosing the higher-severity defensible path, this is network-reachable.\nAC:L - The transmit path is repeatable and has no unusual prerequisite beyond traffic through the affected interface; the UAF is a normal asynchronous URB completion lifetime bug. Under the required guidance, UAF/race uncertainty is scored low complexity unless clearly beyond attacker influence.\nPR:N - Network-triggered host replies require no local account or authentication. Even the local sendto() path has no driver privilege check, but the network path supports PR:N.\nUI:N - No victim action is needed once the affected interface is present and configured. Packets or induced replies can repeatedly drive the transmit path.\nS:U - The corruption occurs within the kernel networking/USB driver security authority. There is no VM escape, IOMMU bypass, or cross-scope boundary identified.\nC:H - This is a slab use-after-free on an skb after the completion path can free it. Per the required kernel guidance, UAFs are scored as high confidentiality impact because freed object reuse can enable information disclosure.\nI:H - Use-after-free memory lifetime bugs can be shaped through heap reuse and may provide write/control-flow primitives. Per the required guidance, UAFs are high integrity impact.\nA:H - The reported bug is a KASAN slab-use-after-free in kernel transmit code and can crash or destabilize the kernel when triggered repeatedly. Per the required guidance, UAFs have high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:20.308Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5af290c86fa81ddbc86a08d54229af5daa40c6a4"
},
{
"url": "https://git.kernel.org/stable/c/24831b0b2ada9fef18d1f486b7b7c444ee5ba637"
},
{
"url": "https://git.kernel.org/stable/c/423b5b86e14e190f6e3161eb5f2ea5f908295ba7"
},
{
"url": "https://git.kernel.org/stable/c/5db090ca07b28a63fb1499690cf19a3f3adafacb"
},
{
"url": "https://git.kernel.org/stable/c/30cf9829d09ca958279c937af8e35495cd2f1e09"
},
{
"url": "https://git.kernel.org/stable/c/6999d70e0eda39af029fa1891c48f0a8832b09d5"
},
{
"url": "https://git.kernel.org/stable/c/4dd7eb94f79486b77ca6b4c8676aedbc465dc802"
},
{
"url": "https://git.kernel.org/stable/c/23f0e34c64acba15cad4d23e50f41f533da195fa"
}
],
"title": "net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52982",
"datePublished": "2026-06-24T16:28:57.763Z",
"dateReserved": "2026-06-09T07:44:35.376Z",
"dateUpdated": "2026-08-05T12:32:20.308Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53093 (GCVE-0-2026-53093)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-06-24 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: Fix error pointer dereference
The function brcmf_chip_add_core() can return an error pointer and is
not checked. Add checks for error pointer.
Detected by Smatch:
drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1010 brcmf_chip_recognition() error:
'core' dereferencing possible ERR_PTR()
drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1013 brcmf_chip_recognition() error:
'core' dereferencing possible ERR_PTR()
drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1016 brcmf_chip_recognition() error:
'core' dereferencing possible ERR_PTR()
drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1019 brcmf_chip_recognition() error:
'core' dereferencing possible ERR_PTR()
drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1022 brcmf_chip_recognition() error:
'core' dereferencing possible ERR_PTR()
[add missing wifi: prefix]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cb7cf7be9eba76f3cd6258906074c72084570c84 Version: cb7cf7be9eba76f3cd6258906074c72084570c84 Version: cb7cf7be9eba76f3cd6258906074c72084570c84 Version: cb7cf7be9eba76f3cd6258906074c72084570c84 Version: cb7cf7be9eba76f3cd6258906074c72084570c84 Version: cb7cf7be9eba76f3cd6258906074c72084570c84 Version: cb7cf7be9eba76f3cd6258906074c72084570c84 Version: cb7cf7be9eba76f3cd6258906074c72084570c84 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a3b45090a91e2f0b9715870d8f8d9ca2fdfbc1af",
"status": "affected",
"version": "cb7cf7be9eba76f3cd6258906074c72084570c84",
"versionType": "git"
},
{
"lessThan": "99ef547659178eef6d6ba4738a9d989ce90cf909",
"status": "affected",
"version": "cb7cf7be9eba76f3cd6258906074c72084570c84",
"versionType": "git"
},
{
"lessThan": "bd6c906e0c4af6d5d0c49c3c4ee090b4913da17d",
"status": "affected",
"version": "cb7cf7be9eba76f3cd6258906074c72084570c84",
"versionType": "git"
},
{
"lessThan": "d3f280be48f1c672cb10e8026c236d0cca60048a",
"status": "affected",
"version": "cb7cf7be9eba76f3cd6258906074c72084570c84",
"versionType": "git"
},
{
"lessThan": "2e0e5a43ed126f896a4ad31ade66c90270601bae",
"status": "affected",
"version": "cb7cf7be9eba76f3cd6258906074c72084570c84",
"versionType": "git"
},
{
"lessThan": "cbea71b4480394708f9a6e007a0385acfe5e1ec8",
"status": "affected",
"version": "cb7cf7be9eba76f3cd6258906074c72084570c84",
"versionType": "git"
},
{
"lessThan": "334c68750eee84c2327db1d152be83ff5ad8e20b",
"status": "affected",
"version": "cb7cf7be9eba76f3cd6258906074c72084570c84",
"versionType": "git"
},
{
"lessThan": "dd8592fc6007a451c3e4b9025de365e39de8178a",
"status": "affected",
"version": "cb7cf7be9eba76f3cd6258906074c72084570c84",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.15"
},
{
"lessThan": "3.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: Fix error pointer dereference\n\nThe function brcmf_chip_add_core() can return an error pointer and is\nnot checked. Add checks for error pointer.\n\nDetected by Smatch:\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1010 brcmf_chip_recognition() error:\n\u0027core\u0027 dereferencing possible ERR_PTR()\n\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1013 brcmf_chip_recognition() error:\n\u0027core\u0027 dereferencing possible ERR_PTR()\n\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1016 brcmf_chip_recognition() error:\n\u0027core\u0027 dereferencing possible ERR_PTR()\n\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1019 brcmf_chip_recognition() error:\n\u0027core\u0027 dereferencing possible ERR_PTR()\n\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1022 brcmf_chip_recognition() error:\n\u0027core\u0027 dereferencing possible ERR_PTR()\n\n[add missing wifi: prefix]"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:32.053Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a3b45090a91e2f0b9715870d8f8d9ca2fdfbc1af"
},
{
"url": "https://git.kernel.org/stable/c/99ef547659178eef6d6ba4738a9d989ce90cf909"
},
{
"url": "https://git.kernel.org/stable/c/bd6c906e0c4af6d5d0c49c3c4ee090b4913da17d"
},
{
"url": "https://git.kernel.org/stable/c/d3f280be48f1c672cb10e8026c236d0cca60048a"
},
{
"url": "https://git.kernel.org/stable/c/2e0e5a43ed126f896a4ad31ade66c90270601bae"
},
{
"url": "https://git.kernel.org/stable/c/cbea71b4480394708f9a6e007a0385acfe5e1ec8"
},
{
"url": "https://git.kernel.org/stable/c/334c68750eee84c2327db1d152be83ff5ad8e20b"
},
{
"url": "https://git.kernel.org/stable/c/dd8592fc6007a451c3e4b9025de365e39de8178a"
}
],
"title": "wifi: brcmfmac: Fix error pointer dereference",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53093",
"datePublished": "2026-06-24T16:30:32.053Z",
"dateReserved": "2026-06-09T07:44:35.384Z",
"dateUpdated": "2026-06-24T16:30:32.053Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-50722 (GCVE-0-2026-50722)
Vulnerability from cvelistv5
Published
2026-07-02 21:34
Modified
2026-07-07 17:02
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
VLAI Severity ?
EPSS score ?
Summary
Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| The Libreswan Project | libreswan |
Version: 0 ≤ 5.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50722",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-06T18:12:19.317302Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-07T17:02:06.722Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/libreswan/libreswan",
"defaultStatus": "unaffected",
"packageName": "libreswan",
"product": "libreswan",
"programRoutines": [
{
"name": "RSA_authenticate_hash_signature_pkcs1_1_5_rsa"
}
],
"repo": "https://github.com/libreswan/libreswan",
"vendor": "The Libreswan Project",
"versions": [
{
"lessThanOrEqual": "5.3",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.3.1",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "Any server or client that accepts RSA-based IKEv2 connections via the default authby= settings is vulnerable to denial of service. Authentication bypass additionally requires the use of RSA keys with weak exponents (e=3). IKEv2 by default allows ECDSA, RSA-SSA-PSS, and RSA PKCS#1 1.5 as fallback due to Microsoft Windows not supporting RSASSA-PSS."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yeonghyeon Choi"
},
{
"lang": "en",
"type": "finder",
"value": "Duyeong Kim"
},
{
"lang": "en",
"type": "analyst",
"value": "Andrew Cagney (The Libreswan Team)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eLibreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.\u003c/p\u003e"
}
],
"value": "Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected."
}
],
"exploits": [
{
"lang": "en",
"value": "No known exploitation in the wild. The authentication bypass requires the target to use RSA keys with weak exponents (e=3), which have been disallowed by most cryptographic libraries for at least a decade. The denial-of-service attack is exploitable against any IKEv2 configuration using default authby= settings that permit RSA PKCS#1 v1.5 fallback."
}
],
"impacts": [
{
"capecId": "CAPEC-463",
"descriptions": [
{
"lang": "en",
"value": "Denial of Service via assertion failure in pluto daemon when processing malformed RSA PKCS#1 v1.5 AUTH payloads"
}
]
},
{
"capecId": "CAPEC-473",
"descriptions": [
{
"lang": "en",
"value": "Authentication bypass via Bleichenbacher-style signature forgery when weak RSA exponents (e.g., e=3) are in use"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "Weak RSA exponent (e=3) in use, enabling Bleichenbacher signature forgery"
}
]
},
{
"other": {
"content": {
"description": "Vendor-assessed severity: Medium. Authentication bypass requires weak RSA exponents (e=3) which have been disallowed by most cryptographic libraries for over a decade. DoS is mitigated by automatic daemon restart.",
"value": "MEDIUM"
},
"type": "vendorSeverity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347: Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-617",
"description": "CWE-617: Reachable Assertion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-02T21:34:41.413Z",
"orgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
"shortName": "libreswan"
},
"references": [
{
"name": "Libreswan Security Advisory CVE-2026-50722",
"tags": [
"vendor-advisory"
],
"url": "https://libreswan.org/security/CVE-2026-50722/CVE-2026-50722.txt"
},
{
"name": "Libreswan CVE-2026-50722 Patches",
"tags": [
"patch"
],
"url": "https://libreswan.org/security/CVE-2026-50722/"
},
{
"name": "Related: CVE-2026-50721 (IKEv1 variant)",
"tags": [
"related"
],
"url": "https://libreswan.org/security/CVE-2026-50721/CVE-2026-50721.txt"
},
{
"name": "RFC 8017 - PKCS #1: RSA Cryptography Specifications Version 2.2",
"tags": [
"technical-description"
],
"url": "https://www.rfc-editor.org/rfc/rfc8017"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to libreswan 5.3.1 or later. Patches for libreswan 4.15 and 5.3 are available at \u003ca href=\"https://libreswan.org/security/CVE-2026-50722/\"\u003ehttps://libreswan.org/security/CVE-2026-50722/\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "Upgrade to libreswan 5.3.1 or later. Patches for libreswan 4.15 and 5.3 are available at https://libreswan.org/security/CVE-2026-50722/"
}
],
"source": {
"defects": [
"CVE-2026-50722"
],
"discovery": "EXTERNAL"
},
"taxonomyMappings": [
{
"taxonomyName": "ATT\u0026CK",
"taxonomyRelations": [
{
"relationshipName": "maps to",
"relationshipValue": "Application or System Exploitation (DoS)",
"taxonomyId": "T1499.004"
}
],
"taxonomyVersion": "15.1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-24T00:00:00.000Z",
"value": "Libreswan notified of the issue via security@libreswan.org"
},
{
"lang": "en",
"time": "2026-06-16T00:00:00.000Z",
"value": "Advanced notice given to supported customers and distributions"
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Public announcement and release of libreswan 5.3.1"
}
],
"title": "IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIf Windows support is not needed, configure \u003ccode\u003eauthby=ecdsa\u003c/code\u003e or \u003ccode\u003eauthby=rsa-sha2\u003c/code\u003e (or both via \u003ccode\u003eauthby=ecdsa,rsa-sha2\u003c/code\u003e) to disallow the fallback of RSA PKCS#1 1.5. The \u003ccode\u003eleftauth=\u003c/code\u003e and \u003ccode\u003erightauth=\u003c/code\u003e settings can be updated similarly if those are in use instead of \u003ccode\u003eauthby\u003c/code\u003e.\u003c/p\u003e"
}
],
"value": "If Windows support is not needed, configure authby=ecdsa or authby=rsa-sha2 (or both via authby=ecdsa,rsa-sha2) to disallow the fallback of RSA PKCS#1 1.5. The leftauth= and rightauth= settings can be updated similarly if those are in use instead of authby."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
"assignerShortName": "libreswan",
"cveId": "CVE-2026-50722",
"datePublished": "2026-07-02T21:34:41.413Z",
"dateReserved": "2026-06-05T16:10:05.751Z",
"dateUpdated": "2026-07-07T17:02:06.722Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53293 (GCVE-0-2026-53293)
Vulnerability from cvelistv5
Published
2026-06-26 19:40
Modified
2026-06-26 19:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG
There were multiple issues in that code.
First of all the order between the reset semaphore and the mm_lock was
wrong (e.g. copy_to_user) was called while holding the lock.
Then we allocated memory while holding the reset semaphore which is also
a pretty big bug and can deadlock.
Then we used down_read_trylock() instead of waiting for the reset to
finish.
(cherry picked from commit 361b6e6b303d4b691f6c5974d3eaab67ca6dd90e)
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8361e3f7882876d98ba98cae0d3149450dd80912 Version: 9e823f307074c0f82b5f6044943b0086e3079bed Version: 9e823f307074c0f82b5f6044943b0086e3079bed Version: 9e823f307074c0f82b5f6044943b0086e3079bed Version: 9e823f307074c0f82b5f6044943b0086e3079bed Version: 17a98c942cb106ec08564e8f43b5470a4dd5d3f6 Version: 9a98563345697bdb1d3410ff428473b2e781f4db Version: 6.6.55 ≤ Version: 6.10.14 ≤ Version: 6.11.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8c4254c8f5836e77ae83e7fc037f02b69f7a0977",
"status": "affected",
"version": "8361e3f7882876d98ba98cae0d3149450dd80912",
"versionType": "git"
},
{
"lessThan": "61957c2e467b39b528a290016367d32a433fa846",
"status": "affected",
"version": "9e823f307074c0f82b5f6044943b0086e3079bed",
"versionType": "git"
},
{
"lessThan": "a31c3feb54b15a90232e497ad0e27e8a82052d8d",
"status": "affected",
"version": "9e823f307074c0f82b5f6044943b0086e3079bed",
"versionType": "git"
},
{
"lessThan": "5c29d20470d4566d1b68df57097d642d01f8b427",
"status": "affected",
"version": "9e823f307074c0f82b5f6044943b0086e3079bed",
"versionType": "git"
},
{
"lessThan": "0ef196a208385b7d7da79f411c161b04e97283e2",
"status": "affected",
"version": "9e823f307074c0f82b5f6044943b0086e3079bed",
"versionType": "git"
},
{
"status": "affected",
"version": "17a98c942cb106ec08564e8f43b5470a4dd5d3f6",
"versionType": "git"
},
{
"status": "affected",
"version": "9a98563345697bdb1d3410ff428473b2e781f4db",
"versionType": "git"
},
{
"lessThan": "6.6.141",
"status": "affected",
"version": "6.6.55",
"versionType": "semver"
},
{
"lessThan": "6.11",
"status": "affected",
"version": "6.10.14",
"versionType": "semver"
},
{
"lessThan": "6.12",
"status": "affected",
"version": "6.11.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "6.6.55",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.10.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.11.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG\n\nThere were multiple issues in that code.\n\nFirst of all the order between the reset semaphore and the mm_lock was\nwrong (e.g. copy_to_user) was called while holding the lock.\n\nThen we allocated memory while holding the reset semaphore which is also\na pretty big bug and can deadlock.\n\nThen we used down_read_trylock() instead of waiting for the reset to\nfinish.\n\n(cherry picked from commit 361b6e6b303d4b691f6c5974d3eaab67ca6dd90e)"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-26T19:40:52.132Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8c4254c8f5836e77ae83e7fc037f02b69f7a0977"
},
{
"url": "https://git.kernel.org/stable/c/61957c2e467b39b528a290016367d32a433fa846"
},
{
"url": "https://git.kernel.org/stable/c/a31c3feb54b15a90232e497ad0e27e8a82052d8d"
},
{
"url": "https://git.kernel.org/stable/c/5c29d20470d4566d1b68df57097d642d01f8b427"
},
{
"url": "https://git.kernel.org/stable/c/0ef196a208385b7d7da79f411c161b04e97283e2"
}
],
"title": "drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53293",
"datePublished": "2026-06-26T19:40:52.132Z",
"dateReserved": "2026-06-09T07:44:35.396Z",
"dateUpdated": "2026-06-26T19:40:52.132Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52920 (GCVE-0-2026-52920)
Vulnerability from cvelistv5
Published
2026-06-24 07:14
Modified
2026-08-05 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xt_policy: fix strict mode inbound policy matching
match_policy_in() walks sec_path entries from the last transform to the
first one, but strict policy matching needs to consume info->pol[] in
the same forward order as the rule layout.
Derive the strict-match policy position from the number of transforms
already consumed so that multi-element inbound rules are matched
consistently.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c4b885139203d37f76662c37ae645fe8e0f4e4e5 Version: c4b885139203d37f76662c37ae645fe8e0f4e4e5 Version: c4b885139203d37f76662c37ae645fe8e0f4e4e5 Version: c4b885139203d37f76662c37ae645fe8e0f4e4e5 Version: c4b885139203d37f76662c37ae645fe8e0f4e4e5 Version: c4b885139203d37f76662c37ae645fe8e0f4e4e5 Version: c4b885139203d37f76662c37ae645fe8e0f4e4e5 Version: c4b885139203d37f76662c37ae645fe8e0f4e4e5 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/xt_policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "eb323f7b82d2e2f638de0cc2a177803eb20e0707",
"status": "affected",
"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5",
"versionType": "git"
},
{
"lessThan": "fc1c518bb1f054831ecabb32da9b8e1dff9699c6",
"status": "affected",
"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5",
"versionType": "git"
},
{
"lessThan": "f98b7f85e04b40e28b08c461ded0cc79f14f5509",
"status": "affected",
"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5",
"versionType": "git"
},
{
"lessThan": "82664d0f1ba25e4f9a71994954abae24c60f4067",
"status": "affected",
"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5",
"versionType": "git"
},
{
"lessThan": "b130a6eefa02bd4d475f2f059da8bcfb3e7d18d9",
"status": "affected",
"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5",
"versionType": "git"
},
{
"lessThan": "938867e870fb5471bb16f442aeac81326e05bf65",
"status": "affected",
"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5",
"versionType": "git"
},
{
"lessThan": "392cc1d8408b5665215c1e9290bbf0f92339b043",
"status": "affected",
"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5",
"versionType": "git"
},
{
"lessThan": "4b2b4d7d4e203c92db8966b163edfacb1f0e1e29",
"status": "affected",
"version": "c4b885139203d37f76662c37ae645fe8e0f4e4e5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/xt_policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.17"
},
{
"lessThan": "2.6.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "2.6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "2.6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "2.6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "2.6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_policy: fix strict mode inbound policy matching\n\nmatch_policy_in() walks sec_path entries from the last transform to the\nfirst one, but strict policy matching needs to consume info-\u003epol[] in\nthe same forward order as the rule layout.\n\nDerive the strict-match policy position from the number of transforms\nalready consumed so that multi-element inbound rules are matched\nconsistently."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable matcher is executed while processing inbound IPv4/IPv6 packets through x_tables after XFRM/IPsec has populated the packet sec_path. A remote IPsec peer can trigger the affected strict inbound policy rule by sending network packets in a realistic VPN/gateway deployment.\nAC:L - Exploitation requires a strict inbound xt_policy rule with multiple policy elements and a packet with the same number of transforms, but those are normal affected configurations rather than attacker-uncontrolled races. Once present, triggering is repeatable by sending matching packets.\nPR:L - Unauthenticated packets generally fail XFRM state/authentication before reaching this sec_path-based match, so the network scenario requires an authorized IPsec peer or equivalent low privilege. Locally, the rule/XFRM setup is gated by CAP_NET_ADMIN in the network namespace, which is reachable through user namespaces.\nUI:N - No victim user action is needed after the vulnerable rule/state configuration exists. Packet delivery or local namespace traffic is sufficient to invoke the matcher.\nS:U - The bug is in kernel netfilter/XFRM policy evaluation and impacts the same kernel/network security authority. It does not cross a VM, IOMMU, or separate sandbox security scope.\nC:H - The old strict inbound index calculation can make pos negative and read before info-\u003epol[], including x_tables rule metadata or adjacent kernel allocation contents. Although exposed through match behavior rather than a direct copy_to_user, this is an out-of-bounds kernel read larger than a few bytes, so the higher confidentiality impact is warranted.\nI:L - The bug does not provide a direct write primitive or code execution path, but it can make strict IPsec policy matching produce incorrect firewall decisions. That can bypass or misapply intended packet filtering for affected multi-element inbound rules.\nA:H - The negative-index read can reach outside the intended match data and, for larger strict transform counts or unlucky layout, may fault/oops in kernel packet processing. The condition can be triggered repeatedly with packets once the affected rule path is reachable."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:42.384Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/eb323f7b82d2e2f638de0cc2a177803eb20e0707"
},
{
"url": "https://git.kernel.org/stable/c/fc1c518bb1f054831ecabb32da9b8e1dff9699c6"
},
{
"url": "https://git.kernel.org/stable/c/f98b7f85e04b40e28b08c461ded0cc79f14f5509"
},
{
"url": "https://git.kernel.org/stable/c/82664d0f1ba25e4f9a71994954abae24c60f4067"
},
{
"url": "https://git.kernel.org/stable/c/b130a6eefa02bd4d475f2f059da8bcfb3e7d18d9"
},
{
"url": "https://git.kernel.org/stable/c/938867e870fb5471bb16f442aeac81326e05bf65"
},
{
"url": "https://git.kernel.org/stable/c/392cc1d8408b5665215c1e9290bbf0f92339b043"
},
{
"url": "https://git.kernel.org/stable/c/4b2b4d7d4e203c92db8966b163edfacb1f0e1e29"
}
],
"title": "netfilter: xt_policy: fix strict mode inbound policy matching",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52920",
"datePublished": "2026-06-24T07:14:15.866Z",
"dateReserved": "2026-06-09T07:44:35.367Z",
"dateUpdated": "2026-08-05T12:31:42.384Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52998 (GCVE-0-2026-52998)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check
The nf_osf_ttl() function accessed skb->dev to perform a local interface
address lookup without verifying that the device pointer was valid.
Additionally, the implementation utilized an in_dev_for_each_ifa_rcu
loop to match the packet source address against local interface
addresses. It assumed that packets from the same subnet should not see a
decrement on the initial TTL. A packet might appear it is from the same
subnet but it actually isn't especially in modern environments with
containers and virtual switching.
Remove the device dereference and interface loop. Replace the logic with
a switch statement that evaluates the TTL according to the ttl_check.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 Version: 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 Version: 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 Version: 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 Version: 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 Version: 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 Version: 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 Version: 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nfnetlink_osf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f4de0777e4554a7de19c920accde6319dd530782",
"status": "affected",
"version": "11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384",
"versionType": "git"
},
{
"lessThan": "c996a90f3071cf43683e5423da31aadbe002b8b4",
"status": "affected",
"version": "11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384",
"versionType": "git"
},
{
"lessThan": "edc806f9122961f0d3819f7c69c14cccde31f277",
"status": "affected",
"version": "11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384",
"versionType": "git"
},
{
"lessThan": "5d05de2f0928d81309a815ecc76d1a3ad72cbc16",
"status": "affected",
"version": "11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384",
"versionType": "git"
},
{
"lessThan": "95be653a76793856ff8b2d8bd82c2943c23f5ca8",
"status": "affected",
"version": "11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384",
"versionType": "git"
},
{
"lessThan": "79b90a96688e521771fa6ed3dc7864b76b8df293",
"status": "affected",
"version": "11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384",
"versionType": "git"
},
{
"lessThan": "83fc5dd63455a779ea2dd0f7ffee3c920919d80b",
"status": "affected",
"version": "11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384",
"versionType": "git"
},
{
"lessThan": "711987ba281fd806322a7cd244e98e2a81903114",
"status": "affected",
"version": "11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nfnetlink_osf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.31"
},
{
"lessThan": "2.6.31",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.31",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_osf: fix potential NULL dereference in ttl check\n\nThe nf_osf_ttl() function accessed skb-\u003edev to perform a local interface\naddress lookup without verifying that the device pointer was valid.\n\nAdditionally, the implementation utilized an in_dev_for_each_ifa_rcu\nloop to match the packet source address against local interface\naddresses. It assumed that packets from the same subnet should not see a\ndecrement on the initial TTL. A packet might appear it is from the same\nsubnet but it actually isn\u0027t especially in modern environments with\ncontainers and virtual switching.\n\nRemove the device dereference and interface loop. Replace the logic with\na switch statement that evaluates the TTL according to the ttl_check."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable OSF match runs from IPv4 PRE_ROUTING/LOCAL_IN/FORWARD packet receive paths, and a remote TCP SYN can reach it on a firewall/bridge host using xt_osf or nft_osf.\nAC:L - There is no race or probabilistic condition; with OSF TTL_LESS active on a device lacking IPv4 configuration, the attacker can craft a SYN with TTL greater than the fingerprint TTL to trigger the NULL dereference reliably.\nPR:N - In the highest reasonable deployment, the OSF rule and fingerprints are already configured by the system, and the attacker only needs to send network traffic to the target.\nUI:N - No victim user action is needed; packet reception and netfilter rule evaluation trigger the bug automatically.\nS:U - The crash occurs within the same kernel/network filtering security authority and does not cross a VM, device-isolation, or sandbox boundary.\nC:N - The bug is a NULL pointer dereference of missing IPv4 device state, with no evidence of attacker-controlled memory disclosure.\nI:N - The vulnerable path does not provide a write primitive or data modification; it only dereferences NULL during TTL/local-address checking.\nA:H - The NULL dereference causes a kernel oops/panic in the packet receive path, producing a high-impact denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:28.947Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f4de0777e4554a7de19c920accde6319dd530782"
},
{
"url": "https://git.kernel.org/stable/c/c996a90f3071cf43683e5423da31aadbe002b8b4"
},
{
"url": "https://git.kernel.org/stable/c/edc806f9122961f0d3819f7c69c14cccde31f277"
},
{
"url": "https://git.kernel.org/stable/c/5d05de2f0928d81309a815ecc76d1a3ad72cbc16"
},
{
"url": "https://git.kernel.org/stable/c/95be653a76793856ff8b2d8bd82c2943c23f5ca8"
},
{
"url": "https://git.kernel.org/stable/c/79b90a96688e521771fa6ed3dc7864b76b8df293"
},
{
"url": "https://git.kernel.org/stable/c/83fc5dd63455a779ea2dd0f7ffee3c920919d80b"
},
{
"url": "https://git.kernel.org/stable/c/711987ba281fd806322a7cd244e98e2a81903114"
}
],
"title": "netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52998",
"datePublished": "2026-06-24T16:29:10.874Z",
"dateReserved": "2026-06-09T07:44:35.377Z",
"dateUpdated": "2026-08-05T12:32:28.947Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52999 (GCVE-0-2026-52999)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
In nf_osf_match(), the nf_osf_hdr_ctx structure is initialized once
and passed by reference to nf_osf_match_one() for each fingerprint
checked. During TCP option parsing, nf_osf_match_one() advances the
shared ctx->optp pointer.
If a fingerprint perfectly matches, the function returns early without
restoring ctx->optp to its initial state. If the user has configured
NF_OSF_LOGLEVEL_ALL, the loop continues to the next fingerprint.
However, because ctx->optp was not restored, the next call to
nf_osf_match_one() starts parsing from the end of the options buffer.
This causes subsequent matches to read garbage data and fail
immediately, making it impossible to log more than one match or logging
incorrect matches.
Instead of using a shared ctx->optp pointer, pass the context as a
constant pointer and use a local pointer (optp) for TCP option
traversal. This makes nf_osf_match_one() strictly stateless from the
caller's perspective, ensuring every fingerprint check starts at the
correct option offset.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b Version: 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b Version: 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b Version: 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b Version: 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b Version: 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b Version: 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b Version: 1a6a0951fc009f6d9fe8ebea2d2417d80d54097b Version: 0c1054e0e5fdef2369fb089e94def978bd209e1f Version: 8316b60582facd4068fb0916c4db2418c21b7174 Version: 4.19.26 ≤ Version: 4.20.13 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nfnetlink_osf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0145548346c4a30981a870a8ca00eac46ba27e85",
"status": "affected",
"version": "1a6a0951fc009f6d9fe8ebea2d2417d80d54097b",
"versionType": "git"
},
{
"lessThan": "1c136f2c44a5913646bac85303612fd0825197a0",
"status": "affected",
"version": "1a6a0951fc009f6d9fe8ebea2d2417d80d54097b",
"versionType": "git"
},
{
"lessThan": "1e19a07291bb8682c14c39a64725a3ae54ab8ccc",
"status": "affected",
"version": "1a6a0951fc009f6d9fe8ebea2d2417d80d54097b",
"versionType": "git"
},
{
"lessThan": "32e50f92c7cf3f4eba29622179a5fcdc2aebab41",
"status": "affected",
"version": "1a6a0951fc009f6d9fe8ebea2d2417d80d54097b",
"versionType": "git"
},
{
"lessThan": "70a3f31d25cf2ec9d4ddfa408120171ead955623",
"status": "affected",
"version": "1a6a0951fc009f6d9fe8ebea2d2417d80d54097b",
"versionType": "git"
},
{
"lessThan": "21883587593d7c8bb519a79460a0b5bc5ffbdabd",
"status": "affected",
"version": "1a6a0951fc009f6d9fe8ebea2d2417d80d54097b",
"versionType": "git"
},
{
"lessThan": "edb78a142d2e5948e63647c0646aa7e7886935f0",
"status": "affected",
"version": "1a6a0951fc009f6d9fe8ebea2d2417d80d54097b",
"versionType": "git"
},
{
"lessThan": "f5ca450087c3baf3651055e7a6de92600f827af3",
"status": "affected",
"version": "1a6a0951fc009f6d9fe8ebea2d2417d80d54097b",
"versionType": "git"
},
{
"status": "affected",
"version": "0c1054e0e5fdef2369fb089e94def978bd209e1f",
"versionType": "git"
},
{
"status": "affected",
"version": "8316b60582facd4068fb0916c4db2418c21b7174",
"versionType": "git"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.26",
"versionType": "semver"
},
{
"lessThan": "4.21",
"status": "affected",
"version": "4.20.13",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nfnetlink_osf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.20.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_osf: fix out-of-bounds read on option matching\n\nIn nf_osf_match(), the nf_osf_hdr_ctx structure is initialized once\nand passed by reference to nf_osf_match_one() for each fingerprint\nchecked. During TCP option parsing, nf_osf_match_one() advances the\nshared ctx-\u003eoptp pointer.\n\nIf a fingerprint perfectly matches, the function returns early without\nrestoring ctx-\u003eoptp to its initial state. If the user has configured\nNF_OSF_LOGLEVEL_ALL, the loop continues to the next fingerprint.\nHowever, because ctx-\u003eoptp was not restored, the next call to\nnf_osf_match_one() starts parsing from the end of the options buffer.\nThis causes subsequent matches to read garbage data and fail\nimmediately, making it impossible to log more than one match or logging\nincorrect matches.\n\nInstead of using a shared ctx-\u003eoptp pointer, pass the context as a\nconstant pointer and use a local pointer (optp) for TCP option\ntraversal. This makes nf_osf_match_one() strictly stateless from the\ncaller\u0027s perspective, ensuring every fingerprint check starts at the\ncorrect option offset."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable matcher runs on received IPv4 TCP SYN packets in the OSF netfilter hook path once OSF matching is configured, including PRE_ROUTING, LOCAL_IN, and FORWARD. A remote peer can supply the TCP options that drive the vulnerable parsing.\nAC:L - There is no race or hard-to-win timing condition; the attacker can craft and retry SYN packets with chosen TCP options. The need for OSF rules/fingerprints is part of the vulnerable deployment scenario.\nPR:N - The packet-processing path has no attacker privilege or authentication check. CAP_NET_ADMIN checks apply to installing OSF state/rules, not to sending packets that trigger an already configured matcher.\nUI:N - No victim user action is needed after the vulnerable OSF configuration is present. Packets are processed automatically by the kernel receive path.\nS:U - The bug remains within the kernel/netfilter security authority. It does not cross a VM, IOMMU, or other separate security boundary.\nC:H - The bug reads beyond the TCP options buffer or its stack copy during subsequent fingerprint checks after ctx-\u003eoptp has been advanced. Because this is a kernel out-of-bounds read that can expose adjacent kernel memory through matching/logging side effects, confidentiality is High under the required conservative rule.\nI:N - The flaw is an out-of-bounds read and does not provide a write primitive or direct data modification. Incorrect OSF matches/log entries do not amount to modification of protected system data.\nA:H - The out-of-bounds read occurs in the kernel packet path and can be triggered repeatedly by crafted packets. On hardened/debug builds or unfavorable boundary placement it can produce an oops/panic, so availability is scored High conservatively."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:30.042Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0145548346c4a30981a870a8ca00eac46ba27e85"
},
{
"url": "https://git.kernel.org/stable/c/1c136f2c44a5913646bac85303612fd0825197a0"
},
{
"url": "https://git.kernel.org/stable/c/1e19a07291bb8682c14c39a64725a3ae54ab8ccc"
},
{
"url": "https://git.kernel.org/stable/c/32e50f92c7cf3f4eba29622179a5fcdc2aebab41"
},
{
"url": "https://git.kernel.org/stable/c/70a3f31d25cf2ec9d4ddfa408120171ead955623"
},
{
"url": "https://git.kernel.org/stable/c/21883587593d7c8bb519a79460a0b5bc5ffbdabd"
},
{
"url": "https://git.kernel.org/stable/c/edb78a142d2e5948e63647c0646aa7e7886935f0"
},
{
"url": "https://git.kernel.org/stable/c/f5ca450087c3baf3651055e7a6de92600f827af3"
}
],
"title": "netfilter: nfnetlink_osf: fix out-of-bounds read on option matching",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52999",
"datePublished": "2026-06-24T16:29:11.757Z",
"dateReserved": "2026-06-09T07:44:35.377Z",
"dateUpdated": "2026-08-05T12:32:30.042Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53304 (GCVE-0-2026-53304)
Vulnerability from cvelistv5
Published
2026-06-26 19:41
Modified
2026-06-26 19:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: sg: Resolve soft lockup issue when opening /dev/sgX
The parameter def_reserved_size defines the default buffer size reserved
for each Sg_fd and should be restricted to a range between 0 and 1,048,576
(see https://tldp.org/HOWTO/SCSI-Generic-HOWTO/proc.html). Although the
function sg_proc_write_dressz enforces this limit, it is possible to bypass
it by directly modifying the module parameter as shown below, which then
causes a soft lockup:
echo -1 > /sys/module/sg/parameters/def_reserved_size
exec 4<> /dev/sg0
watchdog: BUG: soft lockup - CPU#5 stuck for 26 seconds! [bash:537]
Modules loaded:
CPU: 5 UID: 0 PID: 537 Command: bash, kernel version 6.19.0-rc3+ #134,
PREEMPT disabled
Hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS version
1.16.1-2.fc37 dated 04/01/2014
...
Call Trace:
sg_build_reserve+0x5c/0xa0
sg_add_sfp+0x168/0x270
sg_open+0x16e/0x340
chrdev_open+0xbe/0x230
do_dentry_open+0x175/0x480
vfs_open+0x34/0xf0
do_open+0x265/0x3d0
path_openat+0x110/0x290
do_filp_open+0xc3/0x170
do_sys_openat2+0x71/0xe0
__x64_sys_openat+0x6d/0xa0
do_syscall_64+0x62/0x310
entry_SYSCALL_64_after_hwframe+0x76/0x7e
The fix is to use module_param_cb to validate and reject invalid values
assigned to def_reserved_size.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6460e75a104d10458817d2f5b2fbff775bf0b43a Version: 6460e75a104d10458817d2f5b2fbff775bf0b43a Version: 6460e75a104d10458817d2f5b2fbff775bf0b43a Version: 6460e75a104d10458817d2f5b2fbff775bf0b43a Version: 6460e75a104d10458817d2f5b2fbff775bf0b43a Version: 6460e75a104d10458817d2f5b2fbff775bf0b43a Version: 6460e75a104d10458817d2f5b2fbff775bf0b43a Version: 6460e75a104d10458817d2f5b2fbff775bf0b43a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/sg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3d74e0654ac908c65a8f20373091826fe43b1363",
"status": "affected",
"version": "6460e75a104d10458817d2f5b2fbff775bf0b43a",
"versionType": "git"
},
{
"lessThan": "c47ccfb3d80dfed522ca06a5954ac97488d78c5a",
"status": "affected",
"version": "6460e75a104d10458817d2f5b2fbff775bf0b43a",
"versionType": "git"
},
{
"lessThan": "fe671d3c84ffb1b763d590c25195755adeaadaba",
"status": "affected",
"version": "6460e75a104d10458817d2f5b2fbff775bf0b43a",
"versionType": "git"
},
{
"lessThan": "c5f4a211e82d04ccc1809311322c47023bbe66e2",
"status": "affected",
"version": "6460e75a104d10458817d2f5b2fbff775bf0b43a",
"versionType": "git"
},
{
"lessThan": "9676ca7b1ef31a3a65b3e61e7ce3b54ce7364202",
"status": "affected",
"version": "6460e75a104d10458817d2f5b2fbff775bf0b43a",
"versionType": "git"
},
{
"lessThan": "1afd963fcd963db0dc5d47df6dfcf010c9c4647e",
"status": "affected",
"version": "6460e75a104d10458817d2f5b2fbff775bf0b43a",
"versionType": "git"
},
{
"lessThan": "feade299e932967de27519338d41de348fb5b061",
"status": "affected",
"version": "6460e75a104d10458817d2f5b2fbff775bf0b43a",
"versionType": "git"
},
{
"lessThan": "d06a310b45e153872033dd0cf19d5a2279121099",
"status": "affected",
"version": "6460e75a104d10458817d2f5b2fbff775bf0b43a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/sg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.19"
},
{
"lessThan": "2.6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: sg: Resolve soft lockup issue when opening /dev/sgX\n\nThe parameter def_reserved_size defines the default buffer size reserved\nfor each Sg_fd and should be restricted to a range between 0 and 1,048,576\n(see https://tldp.org/HOWTO/SCSI-Generic-HOWTO/proc.html). Although the\nfunction sg_proc_write_dressz enforces this limit, it is possible to bypass\nit by directly modifying the module parameter as shown below, which then\ncauses a soft lockup:\n\necho -1 \u003e /sys/module/sg/parameters/def_reserved_size\nexec 4\u003c\u003e /dev/sg0\n\nwatchdog: BUG: soft lockup - CPU#5 stuck for 26 seconds! [bash:537]\nModules loaded:\nCPU: 5 UID: 0 PID: 537 Command: bash, kernel version 6.19.0-rc3+ #134,\nPREEMPT disabled\nHardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS version\n1.16.1-2.fc37 dated 04/01/2014\n...\nCall Trace:\n\n sg_build_reserve+0x5c/0xa0\n sg_add_sfp+0x168/0x270\n sg_open+0x16e/0x340\n chrdev_open+0xbe/0x230\n do_dentry_open+0x175/0x480\n vfs_open+0x34/0xf0\n do_open+0x265/0x3d0\n path_openat+0x110/0x290\n do_filp_open+0xc3/0x170\n do_sys_openat2+0x71/0xe0\n __x64_sys_openat+0x6d/0xa0\n do_syscall_64+0x62/0x310\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThe fix is to use module_param_cb to validate and reject invalid values\nassigned to def_reserved_size."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-26T19:41:00.056Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3d74e0654ac908c65a8f20373091826fe43b1363"
},
{
"url": "https://git.kernel.org/stable/c/c47ccfb3d80dfed522ca06a5954ac97488d78c5a"
},
{
"url": "https://git.kernel.org/stable/c/fe671d3c84ffb1b763d590c25195755adeaadaba"
},
{
"url": "https://git.kernel.org/stable/c/c5f4a211e82d04ccc1809311322c47023bbe66e2"
},
{
"url": "https://git.kernel.org/stable/c/9676ca7b1ef31a3a65b3e61e7ce3b54ce7364202"
},
{
"url": "https://git.kernel.org/stable/c/1afd963fcd963db0dc5d47df6dfcf010c9c4647e"
},
{
"url": "https://git.kernel.org/stable/c/feade299e932967de27519338d41de348fb5b061"
},
{
"url": "https://git.kernel.org/stable/c/d06a310b45e153872033dd0cf19d5a2279121099"
}
],
"title": "scsi: sg: Resolve soft lockup issue when opening /dev/sgX",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53304",
"datePublished": "2026-06-26T19:41:00.056Z",
"dateReserved": "2026-06-09T07:44:35.397Z",
"dateUpdated": "2026-06-26T19:41:00.056Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52974 (GCVE-0-2026-52974)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: tls: fix strparser anchor skb leak on offload RX setup failure
When tls_set_device_offload_rx() fails at tls_dev_add(), the error path
calls tls_sw_free_resources_rx() to clean up the SW context that was
initialized by tls_set_sw_offload(). This function calls
tls_sw_release_resources_rx() (which stops the strparser via
tls_strp_stop()) and tls_sw_free_ctx_rx() (which kfrees the context),
but never frees the anchor skb that was allocated by alloc_skb(0) in
tls_strp_init().
Note that tls_sw_free_resources_rx() is exclusively used for this
"failed to start offload" code path, there's no other caller.
The leak did not exist before commit 84c61fe1a75b ("tls: rx: do not use
the standard strparser"), because the standard strparser doesn't try
to pre-allocate an skb.
The normal close path in tls_sk_proto_close() handles cleanup by calling
tls_sw_strparser_done() (which calls tls_strp_done()) after dropping
the socket lock, because tls_strp_done() does cancel_work_sync() and
the strparser work handler takes the socket lock.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 84c61fe1a75b4255df1e1e7c054c9e6d048da417 Version: 84c61fe1a75b4255df1e1e7c054c9e6d048da417 Version: 84c61fe1a75b4255df1e1e7c054c9e6d048da417 Version: 84c61fe1a75b4255df1e1e7c054c9e6d048da417 Version: 84c61fe1a75b4255df1e1e7c054c9e6d048da417 Version: 84c61fe1a75b4255df1e1e7c054c9e6d048da417 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/tls/tls.h",
"net/tls/tls_strp.c",
"net/tls/tls_sw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0c9f399b37ce22a5ed94cc51f03ed07ac7f38e32",
"status": "affected",
"version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
"versionType": "git"
},
{
"lessThan": "688f12aa44511dd57e448eb670075c6302ad1dc1",
"status": "affected",
"version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
"versionType": "git"
},
{
"lessThan": "3c405dfa9619e506e75b8e41f8b29a5b99731877",
"status": "affected",
"version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
"versionType": "git"
},
{
"lessThan": "9c54e76f8d6eb11735918777ef0e0509e089557d",
"status": "affected",
"version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
"versionType": "git"
},
{
"lessThan": "bd07fe6c38b9e44ff3fc02692a53f095c5cc9afc",
"status": "affected",
"version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
"versionType": "git"
},
{
"lessThan": "58689498ca3384851145a754dbb1d8ed1cf9fb54",
"status": "affected",
"version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/tls/tls.h",
"net/tls/tls_strp.c",
"net/tls/tls_sw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: tls: fix strparser anchor skb leak on offload RX setup failure\n\nWhen tls_set_device_offload_rx() fails at tls_dev_add(), the error path\ncalls tls_sw_free_resources_rx() to clean up the SW context that was\ninitialized by tls_set_sw_offload(). This function calls\ntls_sw_release_resources_rx() (which stops the strparser via\ntls_strp_stop()) and tls_sw_free_ctx_rx() (which kfrees the context),\nbut never frees the anchor skb that was allocated by alloc_skb(0) in\ntls_strp_init().\n\nNote that tls_sw_free_resources_rx() is exclusively used for this\n\"failed to start offload\" code path, there\u0027s no other caller.\n\nThe leak did not exist before commit 84c61fe1a75b (\"tls: rx: do not use\nthe standard strparser\"), because the standard strparser doesn\u0027t try\nto pre-allocate an skb.\n\nThe normal close path in tls_sk_proto_close() handles cleanup by calling\ntls_sw_strparser_done() (which calls tls_strp_done()) after dropping\nthe socket lock, because tls_strp_done() does cancel_work_sync() and\nthe strparser work handler takes the socket lock."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A remote TLS peer can plausibly trigger this through a network-facing kTLS-enabled service that installs TLS_RX state after handshake on a TLS RX offload-capable NIC. The direct kernel path is setsockopt-driven, but the vulnerable subsystem is kTLS receive/offload setup for network connections and can be reached per remote connection.\nAC:L - There is no race or fragile timing requirement; the attacker can repeatedly drive RX state setup and can plausibly force tls_dev_add() failure via unsupported TLS 1.2 RX offload parameters or exhausted offload resources. The required offload-capable deployment is a reasonable server scenario for this subsystem.\nPR:N - In the network-facing kTLS service scenario, the attacker needs no local account or prior authentication to initiate TLS connections that cause the service to install RX state. Any application-level authentication would occur after the connection setup path.\nUI:N - No victim user action is required beyond the target service automatically handling incoming TLS connections. The attacker can repeat the trigger by opening connections.\nS:U - The impact remains within the kernel and network stack security authority. There is no VM escape, IOMMU bypass, or cross-scope boundary crossing.\nC:N - The bug leaks an internal zero-length anchor skb object by losing its reference; it does not expose kernel memory contents to the attacker. No read primitive or information disclosure was identified.\nI:N - The issue is a missing cleanup in an error path and does not corrupt memory or modify attacker-chosen kernel data. No write primitive or control-flow impact was identified.\nA:H - The leaked skb is kernel memory and the failing offload setup path can be triggered repeatedly, allowing unbounded memory consumption. Related strparser skb leak precedent treats repeatable network-triggered memory exhaustion as high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:16.022Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0c9f399b37ce22a5ed94cc51f03ed07ac7f38e32"
},
{
"url": "https://git.kernel.org/stable/c/688f12aa44511dd57e448eb670075c6302ad1dc1"
},
{
"url": "https://git.kernel.org/stable/c/3c405dfa9619e506e75b8e41f8b29a5b99731877"
},
{
"url": "https://git.kernel.org/stable/c/9c54e76f8d6eb11735918777ef0e0509e089557d"
},
{
"url": "https://git.kernel.org/stable/c/bd07fe6c38b9e44ff3fc02692a53f095c5cc9afc"
},
{
"url": "https://git.kernel.org/stable/c/58689498ca3384851145a754dbb1d8ed1cf9fb54"
}
],
"title": "net: tls: fix strparser anchor skb leak on offload RX setup failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52974",
"datePublished": "2026-06-24T16:28:51.826Z",
"dateReserved": "2026-06-09T07:44:35.375Z",
"dateUpdated": "2026-08-05T12:32:16.022Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53076 (GCVE-0-2026-53076)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix OOB in pcpu_init_value
An out-of-bounds read occurs when copying element from a
BPF_MAP_TYPE_CGROUP_STORAGE map to another pcpu map with the
same value_size that is not rounded up to 8 bytes.
The issue happens when:
1. A CGROUP_STORAGE map is created with value_size not aligned to
8 bytes (e.g., 4 bytes)
2. A pcpu map is created with the same value_size (e.g., 4 bytes)
3. Update element in 2 with data in 1
pcpu_init_value assumes that all sources are rounded up to 8 bytes,
and invokes copy_map_value_long to make a data copy, However, the
assumption doesn't stand since there are some cases where the source
may not be rounded up to 8 bytes, e.g., CGROUP_STORAGE, skb->data.
the verifier verifies exactly the size that the source claims, not
the size rounded up to 8 bytes by kernel, an OOB happens when the
source has only 4 bytes while the copy size(4) is rounded up to 8.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d3bec0138bfbe58606fc1d6f57a4cdc1a20218db Version: d3bec0138bfbe58606fc1d6f57a4cdc1a20218db Version: d3bec0138bfbe58606fc1d6f57a4cdc1a20218db Version: d3bec0138bfbe58606fc1d6f57a4cdc1a20218db Version: d3bec0138bfbe58606fc1d6f57a4cdc1a20218db Version: c602ad2b52dcbca5af08e5137bd5575c039b52e3 Version: ab68b940dd6f7b5f8e2557937162dcb8a0583a05 Version: 5.4.78 ≤ Version: 5.9.9 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/hashtab.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e19c5ed9f1922a6854073f8651a63fa7be26e9e9",
"status": "affected",
"version": "d3bec0138bfbe58606fc1d6f57a4cdc1a20218db",
"versionType": "git"
},
{
"lessThan": "e0378419b0e20178b5d100b27c9cc7e51064202e",
"status": "affected",
"version": "d3bec0138bfbe58606fc1d6f57a4cdc1a20218db",
"versionType": "git"
},
{
"lessThan": "6086079e6d1c32ba4c4b422612b8aebb1129a96c",
"status": "affected",
"version": "d3bec0138bfbe58606fc1d6f57a4cdc1a20218db",
"versionType": "git"
},
{
"lessThan": "634a793d0e1c822412095d25a1338f8831ad894c",
"status": "affected",
"version": "d3bec0138bfbe58606fc1d6f57a4cdc1a20218db",
"versionType": "git"
},
{
"lessThan": "576afddfee8d1108ee299bf10f581593540d1a36",
"status": "affected",
"version": "d3bec0138bfbe58606fc1d6f57a4cdc1a20218db",
"versionType": "git"
},
{
"status": "affected",
"version": "c602ad2b52dcbca5af08e5137bd5575c039b52e3",
"versionType": "git"
},
{
"status": "affected",
"version": "ab68b940dd6f7b5f8e2557937162dcb8a0583a05",
"versionType": "git"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.78",
"versionType": "semver"
},
{
"lessThan": "5.10",
"status": "affected",
"version": "5.9.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/hashtab.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.9.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix OOB in pcpu_init_value\n\nAn out-of-bounds read occurs when copying element from a\nBPF_MAP_TYPE_CGROUP_STORAGE map to another pcpu map with the\nsame value_size that is not rounded up to 8 bytes.\n\nThe issue happens when:\n1. A CGROUP_STORAGE map is created with value_size not aligned to\n 8 bytes (e.g., 4 bytes)\n2. A pcpu map is created with the same value_size (e.g., 4 bytes)\n3. Update element in 2 with data in 1\n\npcpu_init_value assumes that all sources are rounded up to 8 bytes,\nand invokes copy_map_value_long to make a data copy, However, the\nassumption doesn\u0027t stand since there are some cases where the source\nmay not be rounded up to 8 bytes, e.g., CGROUP_STORAGE, skb-\u003edata.\nthe verifier verifies exactly the size that the source claims, not\nthe size rounded up to 8 bytes by kernel, an OOB happens when the\nsource has only 4 bytes while the copy size(4) is rounded up to 8."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local `bpf(2)` activity: creating BPF maps, loading a BPF program, and invoking `bpf_map_update_elem()` from that program. It is not directly reachable by remote packets without a local attacker-controlled BPF program already installed.\nAC:L - The trigger is deterministic: use a non-8-byte-aligned value size and pass a verifier-valid source buffer into a per-CPU hash update that previously copied the rounded-up size. No race or attacker-external timing condition is required.\nPR:L - A basic local user can reach the most severe reasonable case on systems where unprivileged BPF is enabled, including via socket-filter BPF and packet data sources; otherwise it requires BPF-related capabilities. Under the required higher-severity rule, this is PR:L rather than PR:H.\nUI:N - After the local attacker loads the BPF program and creates the maps, exploitation requires no victim action. The attacker triggers the helper path directly.\nS:U - The affected component and impacted resources are within the same kernel security authority. This is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The bug is an out-of-bounds kernel read whose extra bytes are copied into per-CPU map padding that can be returned through per-CPU map lookup paths. Even though each read is small, repeated attacker-controlled executions can disclose kernel memory, so the higher severity confidentiality value is warranted.\nI:N - The faulty copy writes only into the destination per-CPU map slot\u0027s allocated rounded padding, not past the allocated destination or into security-relevant map value bytes. I found no path turning this into attacker-controlled kernel data modification or control-flow corruption.\nA:H - The reported reproducer is a KASAN slab-out-of-bounds read in a deterministic BPF helper path, and such reachable kernel OOB reads can oops or panic on hardened/sanitized or unlucky layouts. Following the kernel scoring guidance and higher-severity rule, availability is H."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:09.042Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e19c5ed9f1922a6854073f8651a63fa7be26e9e9"
},
{
"url": "https://git.kernel.org/stable/c/e0378419b0e20178b5d100b27c9cc7e51064202e"
},
{
"url": "https://git.kernel.org/stable/c/6086079e6d1c32ba4c4b422612b8aebb1129a96c"
},
{
"url": "https://git.kernel.org/stable/c/634a793d0e1c822412095d25a1338f8831ad894c"
},
{
"url": "https://git.kernel.org/stable/c/576afddfee8d1108ee299bf10f581593540d1a36"
}
],
"title": "bpf: Fix OOB in pcpu_init_value",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53076",
"datePublished": "2026-06-24T16:30:17.092Z",
"dateReserved": "2026-06-09T07:44:35.383Z",
"dateUpdated": "2026-08-05T12:33:09.042Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53295 (GCVE-0-2026-53295)
Vulnerability from cvelistv5
Published
2026-06-26 19:40
Modified
2026-06-26 19:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mailbox: add sanity check for channel array
Fail gracefully if there is no channel array attached to the mailbox
controller. Otherwise the later dereference will cause an OOPS which
might not be seen because mailbox controllers might instantiate very
early. Remove the comment explaining the obvious while here.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c Version: 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c Version: 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c Version: 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c Version: 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c Version: 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c Version: 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c Version: 2b6d83e2b8b7de82331a6a1dcd64b51020a6031c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/mailbox/mailbox.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5cc3300fab262b26c28bc2fc06df693410c3840b",
"status": "affected",
"version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c",
"versionType": "git"
},
{
"lessThan": "0f11444271110d9b5bc6316a153c6431abda899c",
"status": "affected",
"version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c",
"versionType": "git"
},
{
"lessThan": "d44872a569b8fbacde457ff2587a775e5004bb79",
"status": "affected",
"version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c",
"versionType": "git"
},
{
"lessThan": "14aed0d4e58389cc6a88acf8610b12d3e476272b",
"status": "affected",
"version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c",
"versionType": "git"
},
{
"lessThan": "6362c4a7d7e21e68cd9aa04df7cde16befba3a4b",
"status": "affected",
"version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c",
"versionType": "git"
},
{
"lessThan": "9dd7489943324298bb0f385495795a82f1dd6507",
"status": "affected",
"version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c",
"versionType": "git"
},
{
"lessThan": "37792091ab28ba030fd8d61184c47d4d51294170",
"status": "affected",
"version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c",
"versionType": "git"
},
{
"lessThan": "c1aad75595fb67edc7fda8af249d3b886efa1be9",
"status": "affected",
"version": "2b6d83e2b8b7de82331a6a1dcd64b51020a6031c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/mailbox/mailbox.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.18"
},
{
"lessThan": "3.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: add sanity check for channel array\n\nFail gracefully if there is no channel array attached to the mailbox\ncontroller. Otherwise the later dereference will cause an OOPS which\nmight not be seen because mailbox controllers might instantiate very\nearly. Remove the comment explaining the obvious while here."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-26T19:40:53.670Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5cc3300fab262b26c28bc2fc06df693410c3840b"
},
{
"url": "https://git.kernel.org/stable/c/0f11444271110d9b5bc6316a153c6431abda899c"
},
{
"url": "https://git.kernel.org/stable/c/d44872a569b8fbacde457ff2587a775e5004bb79"
},
{
"url": "https://git.kernel.org/stable/c/14aed0d4e58389cc6a88acf8610b12d3e476272b"
},
{
"url": "https://git.kernel.org/stable/c/6362c4a7d7e21e68cd9aa04df7cde16befba3a4b"
},
{
"url": "https://git.kernel.org/stable/c/9dd7489943324298bb0f385495795a82f1dd6507"
},
{
"url": "https://git.kernel.org/stable/c/37792091ab28ba030fd8d61184c47d4d51294170"
},
{
"url": "https://git.kernel.org/stable/c/c1aad75595fb67edc7fda8af249d3b886efa1be9"
}
],
"title": "mailbox: add sanity check for channel array",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53295",
"datePublished": "2026-06-26T19:40:53.670Z",
"dateReserved": "2026-06-09T07:44:35.396Z",
"dateUpdated": "2026-06-26T19:40:53.670Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52958 (GCVE-0-2026-52958)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: Fix potential out-of-bounds access in osdmap_decode()
When decoding osd_state and osd_weight from an incoming osdmap in
osdmap_decode(), both are decoded for each osd, i.e., map->max_osd
times. The ceph_decode_need() check only accounts for
sizeof(*map->osd_weight) once. This can potentially result in an
out-of-bounds memory access if the incoming message is corrupted such
that the max_osd value exceeds the actual content of the osdmap message.
This patch fixes the issue by changing the corresponding part in the
ceph_decode_need() check to account for
map->max_osd*sizeof(*map->osd_weight).
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: dcbc919a5dc8c2629684a113a90c0b6fe10c3462 Version: dcbc919a5dc8c2629684a113a90c0b6fe10c3462 Version: dcbc919a5dc8c2629684a113a90c0b6fe10c3462 Version: dcbc919a5dc8c2629684a113a90c0b6fe10c3462 Version: dcbc919a5dc8c2629684a113a90c0b6fe10c3462 Version: dcbc919a5dc8c2629684a113a90c0b6fe10c3462 Version: dcbc919a5dc8c2629684a113a90c0b6fe10c3462 Version: dcbc919a5dc8c2629684a113a90c0b6fe10c3462 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/osdmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "36a79759a288961b1ff28a68ec2d1f56f6848098",
"status": "affected",
"version": "dcbc919a5dc8c2629684a113a90c0b6fe10c3462",
"versionType": "git"
},
{
"lessThan": "3f2575bb7f955d42569d96c3e04fa958a0dcf4b4",
"status": "affected",
"version": "dcbc919a5dc8c2629684a113a90c0b6fe10c3462",
"versionType": "git"
},
{
"lessThan": "8713bbc4b2b9ad78f803978e54b7e49dd21bd9be",
"status": "affected",
"version": "dcbc919a5dc8c2629684a113a90c0b6fe10c3462",
"versionType": "git"
},
{
"lessThan": "0d2dd7e6bb74fd7712aa73457a4a821906c6863a",
"status": "affected",
"version": "dcbc919a5dc8c2629684a113a90c0b6fe10c3462",
"versionType": "git"
},
{
"lessThan": "e7187f33c02488697ec0d01d82bf7a3f8deaba8f",
"status": "affected",
"version": "dcbc919a5dc8c2629684a113a90c0b6fe10c3462",
"versionType": "git"
},
{
"lessThan": "48df98d12b15360cd56af5c1f460307b340c1197",
"status": "affected",
"version": "dcbc919a5dc8c2629684a113a90c0b6fe10c3462",
"versionType": "git"
},
{
"lessThan": "ee933694645dac062d65fc2743f92bc06fa0db6b",
"status": "affected",
"version": "dcbc919a5dc8c2629684a113a90c0b6fe10c3462",
"versionType": "git"
},
{
"lessThan": "35d0ed82d03e5ee77ea4f31f20e29562a7721649",
"status": "affected",
"version": "dcbc919a5dc8c2629684a113a90c0b6fe10c3462",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/osdmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Fix potential out-of-bounds access in osdmap_decode()\n\nWhen decoding osd_state and osd_weight from an incoming osdmap in\nosdmap_decode(), both are decoded for each osd, i.e., map-\u003emax_osd\ntimes. The ceph_decode_need() check only accounts for\nsizeof(*map-\u003eosd_weight) once. This can potentially result in an\nout-of-bounds memory access if the incoming message is corrupted such\nthat the max_osd value exceeds the actual content of the osdmap message.\n\nThis patch fixes the issue by changing the corresponding part in the\nceph_decode_need() check to account for\nmap-\u003emax_osd*sizeof(*map-\u003eosd_weight)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable decoder processes Ceph OSD map messages received over Ceph messenger connections from monitors or OSDs. A malicious or compromised network Ceph peer can deliver the crafted map to a connected kernel client.\nAC:L - The trigger is a deterministic malformed OSD map with `max_osd` larger than the supplied `osd_weight` content. No race or condition outside the attacker\u0027s control is required.\nPR:N - The attacker does not need privileges on the vulnerable Linux system; the crafted data is supplied by a remote Ceph peer. Ceph also supports auth-none deployments, so the highest defensible scenario does not require authenticated attacker privileges.\nUI:N - Once the kernel Ceph client is connected, OSD map updates are processed asynchronously without a user action. The attacker can trigger parsing by sending the crafted map over the established network connection.\nS:U - The impact is within the kernel/client system that parses the malicious Ceph message. This is not a VM escape, IOMMU bypass, or other cross-scope boundary change.\nC:H - The bug is an out-of-bounds read from the received message buffer, and the read can extend beyond a small bounded area based on attacker-controlled `max_osd`. Following the higher-severity rule for OOB reads, this supports high confidentiality impact.\nI:N - The faulty loop reads past the input buffer into the allocated `osd_weight` array but does not write out of bounds or provide a clear kernel memory write primitive. The malformed full map is rejected after decoding fails.\nA:H - The out-of-bounds kernel read can fault or otherwise crash the kernel when it crosses invalid memory, and malformed OSD maps can be sent repeatedly by the network peer. Kernel crash or oops is high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:08.518Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/36a79759a288961b1ff28a68ec2d1f56f6848098"
},
{
"url": "https://git.kernel.org/stable/c/3f2575bb7f955d42569d96c3e04fa958a0dcf4b4"
},
{
"url": "https://git.kernel.org/stable/c/8713bbc4b2b9ad78f803978e54b7e49dd21bd9be"
},
{
"url": "https://git.kernel.org/stable/c/0d2dd7e6bb74fd7712aa73457a4a821906c6863a"
},
{
"url": "https://git.kernel.org/stable/c/e7187f33c02488697ec0d01d82bf7a3f8deaba8f"
},
{
"url": "https://git.kernel.org/stable/c/48df98d12b15360cd56af5c1f460307b340c1197"
},
{
"url": "https://git.kernel.org/stable/c/ee933694645dac062d65fc2743f92bc06fa0db6b"
},
{
"url": "https://git.kernel.org/stable/c/35d0ed82d03e5ee77ea4f31f20e29562a7721649"
}
],
"title": "libceph: Fix potential out-of-bounds access in osdmap_decode()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52958",
"datePublished": "2026-06-24T16:28:39.723Z",
"dateReserved": "2026-06-09T07:44:35.373Z",
"dateUpdated": "2026-08-05T12:32:08.518Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53034 (GCVE-0-2026-53034)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-06-24 16:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: Fix af_unix null-ptr-deref in proto update
unix_stream_connect() sets sk_state (`WRITE_ONCE(sk->sk_state,
TCP_ESTABLISHED)`) _before_ it assigns a peer (`unix_peer(sk) = newsk`).
sk_state == TCP_ESTABLISHED makes sock_map_sk_state_allowed() believe that
socket is properly set up, which would include having a defined peer. IOW,
there's a window when unix_stream_bpf_update_proto() can be called on
socket which still has unix_peer(sk) == NULL.
CPU0 bpf CPU1 connect
-------- ------------
WRITE_ONCE(sk->sk_state, TCP_ESTABLISHED)
sock_map_sk_state_allowed(sk)
...
sk_pair = unix_peer(sk)
sock_hold(sk_pair)
sock_hold(newsk)
smp_mb__after_atomic()
unix_peer(sk) = newsk
BUG: kernel NULL pointer dereference, address: 0000000000000080
RIP: 0010:unix_stream_bpf_update_proto+0xa0/0x1b0
Call Trace:
sock_map_link+0x564/0x8b0
sock_map_update_common+0x6e/0x340
sock_map_update_elem_sys+0x17d/0x240
__sys_bpf+0x26db/0x3250
__x64_sys_bpf+0x21/0x30
do_syscall_64+0x6b/0x3a0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Initial idea was to move peer assignment _before_ the sk_state update[1],
but that involved an additional memory barrier, and changing the hot path
was rejected.
Then a NULL check during proto update in unix_stream_bpf_update_proto() was
considered[2], but the follow-up discussion[3] focused on the root cause,
i.e. sockmap update taking a wrong lock. Or, more specifically, missing
unix_state_lock()[4].
In the end it was concluded that teaching sockmap about the af_unix locking
would be unnecessarily complex[5].
Complexity aside, since BPF_PROG_TYPE_SCHED_CLS and BPF_PROG_TYPE_SCHED_ACT
are allowed to update sockmaps, sock_map_update_elem() taking the unix
lock, as it is currently implemented in unix_state_lock():
spin_lock(&unix_sk(s)->lock), would be problematic. unix_state_lock() taken
in a process context, followed by a softirq-context TC BPF program
attempting to take the same spinlock -- deadlock[6].
This way we circled back to the peer check idea[2].
[1]: https://lore.kernel.org/netdev/ba5c50aa-1df4-40c2-ab33-a72022c5a32e@rbox.co/
[2]: https://lore.kernel.org/netdev/20240610174906.32921-1-kuniyu@amazon.com/
[3]: https://lore.kernel.org/netdev/7603c0e6-cd5b-452b-b710-73b64bd9de26@linux.dev/
[4]: https://lore.kernel.org/netdev/CAAVpQUA+8GL_j63CaKb8hbxoL21izD58yr1NvhOhU=j+35+3og@mail.gmail.com/
[5]: https://lore.kernel.org/bpf/CAAVpQUAHijOMext28Gi10dSLuMzGYh+jK61Ujn+fZ-wvcODR2A@mail.gmail.com/
[6]: https://lore.kernel.org/bpf/dd043c69-4d03-46fe-8325-8f97101435cf@linux.dev/
Summary of scenarios where af_unix/stream connect() may race a sockmap
update:
1. connect() vs. bpf(BPF_MAP_UPDATE_ELEM), i.e. sock_map_update_elem_sys()
Implemented NULL check is sufficient. Once assigned, socket peer won't
be released until socket fd is released. And that's not an issue because
sock_map_update_elem_sys() bumps fd refcnf.
2. connect() vs BPF program doing update
Update restricted per verifier.c:may_update_sockmap() to
BPF_PROG_TYPE_TRACING/BPF_TRACE_ITER
BPF_PROG_TYPE_SOCK_OPS (bpf_sock_map_update() only)
BPF_PROG_TYPE_SOCKET_FILTER
BPF_PROG_TYPE_SCHED_CLS
BPF_PROG_TYPE_SCHED_ACT
BPF_PROG_TYPE_XDP
BPF_PROG_TYPE_SK_REUSEPORT
BPF_PROG_TYPE_FLOW_DISSECTOR
BPF_PROG_TYPE_SK_LOOKUP
Plus one more race to consider:
CPU0 bpf CPU1 connect
-------- ------------
WRITE_ONCE(sk->sk_state, TCP_ESTABLISHED)
sock_map_sk_state_allowed(sk)
sock_hold(newsk)
smp_mb__after_atomic()
---truncated---
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c63829182c37c2d6d0608976d15fa61ebebe9e6b Version: c63829182c37c2d6d0608976d15fa61ebebe9e6b Version: c63829182c37c2d6d0608976d15fa61ebebe9e6b Version: c63829182c37c2d6d0608976d15fa61ebebe9e6b Version: c63829182c37c2d6d0608976d15fa61ebebe9e6b Version: c63829182c37c2d6d0608976d15fa61ebebe9e6b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/unix/unix_bpf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "75b7d3b3f8bd4e59eb3af1b11a43c64c0c2db6f4",
"status": "affected",
"version": "c63829182c37c2d6d0608976d15fa61ebebe9e6b",
"versionType": "git"
},
{
"lessThan": "a94d3dd78ee8b63e6b8ad629081c952c93ee5a10",
"status": "affected",
"version": "c63829182c37c2d6d0608976d15fa61ebebe9e6b",
"versionType": "git"
},
{
"lessThan": "4913c94a3adcdbb64c552110c0c243cb1fdbb317",
"status": "affected",
"version": "c63829182c37c2d6d0608976d15fa61ebebe9e6b",
"versionType": "git"
},
{
"lessThan": "041eb6348d73ee5e15fc8161f1eac5a6e8289ca0",
"status": "affected",
"version": "c63829182c37c2d6d0608976d15fa61ebebe9e6b",
"versionType": "git"
},
{
"lessThan": "37bfcd164161b47d00b1c3bd20adc816a6977ce0",
"status": "affected",
"version": "c63829182c37c2d6d0608976d15fa61ebebe9e6b",
"versionType": "git"
},
{
"lessThan": "dca38b7734d2ea00af4818ff3ae836fab33d5d5a",
"status": "affected",
"version": "c63829182c37c2d6d0608976d15fa61ebebe9e6b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/unix/unix_bpf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix af_unix null-ptr-deref in proto update\n\nunix_stream_connect() sets sk_state (`WRITE_ONCE(sk-\u003esk_state,\nTCP_ESTABLISHED)`) _before_ it assigns a peer (`unix_peer(sk) = newsk`).\nsk_state == TCP_ESTABLISHED makes sock_map_sk_state_allowed() believe that\nsocket is properly set up, which would include having a defined peer. IOW,\nthere\u0027s a window when unix_stream_bpf_update_proto() can be called on\nsocket which still has unix_peer(sk) == NULL.\n\n CPU0 bpf CPU1 connect\n -------- ------------\n\n WRITE_ONCE(sk-\u003esk_state, TCP_ESTABLISHED)\nsock_map_sk_state_allowed(sk)\n...\nsk_pair = unix_peer(sk)\nsock_hold(sk_pair)\n sock_hold(newsk)\n smp_mb__after_atomic()\n unix_peer(sk) = newsk\n\nBUG: kernel NULL pointer dereference, address: 0000000000000080\nRIP: 0010:unix_stream_bpf_update_proto+0xa0/0x1b0\nCall Trace:\n sock_map_link+0x564/0x8b0\n sock_map_update_common+0x6e/0x340\n sock_map_update_elem_sys+0x17d/0x240\n __sys_bpf+0x26db/0x3250\n __x64_sys_bpf+0x21/0x30\n do_syscall_64+0x6b/0x3a0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nInitial idea was to move peer assignment _before_ the sk_state update[1],\nbut that involved an additional memory barrier, and changing the hot path\nwas rejected.\nThen a NULL check during proto update in unix_stream_bpf_update_proto() was\nconsidered[2], but the follow-up discussion[3] focused on the root cause,\ni.e. sockmap update taking a wrong lock. Or, more specifically, missing\nunix_state_lock()[4].\nIn the end it was concluded that teaching sockmap about the af_unix locking\nwould be unnecessarily complex[5].\nComplexity aside, since BPF_PROG_TYPE_SCHED_CLS and BPF_PROG_TYPE_SCHED_ACT\nare allowed to update sockmaps, sock_map_update_elem() taking the unix\nlock, as it is currently implemented in unix_state_lock():\nspin_lock(\u0026unix_sk(s)-\u003elock), would be problematic. unix_state_lock() taken\nin a process context, followed by a softirq-context TC BPF program\nattempting to take the same spinlock -- deadlock[6].\nThis way we circled back to the peer check idea[2].\n\n[1]: https://lore.kernel.org/netdev/ba5c50aa-1df4-40c2-ab33-a72022c5a32e@rbox.co/\n[2]: https://lore.kernel.org/netdev/20240610174906.32921-1-kuniyu@amazon.com/\n[3]: https://lore.kernel.org/netdev/7603c0e6-cd5b-452b-b710-73b64bd9de26@linux.dev/\n[4]: https://lore.kernel.org/netdev/CAAVpQUA+8GL_j63CaKb8hbxoL21izD58yr1NvhOhU=j+35+3og@mail.gmail.com/\n[5]: https://lore.kernel.org/bpf/CAAVpQUAHijOMext28Gi10dSLuMzGYh+jK61Ujn+fZ-wvcODR2A@mail.gmail.com/\n[6]: https://lore.kernel.org/bpf/dd043c69-4d03-46fe-8325-8f97101435cf@linux.dev/\n\nSummary of scenarios where af_unix/stream connect() may race a sockmap\nupdate:\n\n1. connect() vs. bpf(BPF_MAP_UPDATE_ELEM), i.e. sock_map_update_elem_sys()\n\n Implemented NULL check is sufficient. Once assigned, socket peer won\u0027t\n be released until socket fd is released. And that\u0027s not an issue because\n sock_map_update_elem_sys() bumps fd refcnf.\n\n2. connect() vs BPF program doing update\n\n Update restricted per verifier.c:may_update_sockmap() to\n\n BPF_PROG_TYPE_TRACING/BPF_TRACE_ITER\n BPF_PROG_TYPE_SOCK_OPS (bpf_sock_map_update() only)\n BPF_PROG_TYPE_SOCKET_FILTER\n BPF_PROG_TYPE_SCHED_CLS\n BPF_PROG_TYPE_SCHED_ACT\n BPF_PROG_TYPE_XDP\n BPF_PROG_TYPE_SK_REUSEPORT\n BPF_PROG_TYPE_FLOW_DISSECTOR\n BPF_PROG_TYPE_SK_LOOKUP\n\n Plus one more race to consider:\n\n CPU0 bpf CPU1 connect\n -------- ------------\n\n WRITE_ONCE(sk-\u003esk_state, TCP_ESTABLISHED)\n sock_map_sk_state_allowed(sk)\n sock_hold(newsk)\n smp_mb__after_atomic()\n \n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:29:41.676Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/75b7d3b3f8bd4e59eb3af1b11a43c64c0c2db6f4"
},
{
"url": "https://git.kernel.org/stable/c/a94d3dd78ee8b63e6b8ad629081c952c93ee5a10"
},
{
"url": "https://git.kernel.org/stable/c/4913c94a3adcdbb64c552110c0c243cb1fdbb317"
},
{
"url": "https://git.kernel.org/stable/c/041eb6348d73ee5e15fc8161f1eac5a6e8289ca0"
},
{
"url": "https://git.kernel.org/stable/c/37bfcd164161b47d00b1c3bd20adc816a6977ce0"
},
{
"url": "https://git.kernel.org/stable/c/dca38b7734d2ea00af4818ff3ae836fab33d5d5a"
}
],
"title": "bpf, sockmap: Fix af_unix null-ptr-deref in proto update",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53034",
"datePublished": "2026-06-24T16:29:41.676Z",
"dateReserved": "2026-06-09T07:44:35.380Z",
"dateUpdated": "2026-06-24T16:29:41.676Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53356 (GCVE-0-2026-53356)
Vulnerability from cvelistv5
Published
2026-07-01 13:32
Modified
2026-08-05 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/gem: Fix phys BO pread/pwrite with offset
sg_page() returns struct page pointer not (void *) so the scaling
of pread/pwrite is wrong for phys BO and wrong parts of BO would be
accessed if non-zero offset is used.
Last impacted platform with overlay or cursor planes using phys
mapping was Gen3/945G/Lakeport.
(cherry picked from commit 3e49a2f85070b2fb672c1e0fdba281a4ea3aebe6)
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c6790dc22312f592c1434577258b31c48c72d52a Version: c6790dc22312f592c1434577258b31c48c72d52a Version: c6790dc22312f592c1434577258b31c48c72d52a Version: c6790dc22312f592c1434577258b31c48c72d52a Version: c6790dc22312f592c1434577258b31c48c72d52a Version: c6790dc22312f592c1434577258b31c48c72d52a Version: c6790dc22312f592c1434577258b31c48c72d52a Version: c6790dc22312f592c1434577258b31c48c72d52a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/i915/gem/i915_gem_phys.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "40f738991058eb3e3530c3006a5bd6fd5e29f035",
"status": "affected",
"version": "c6790dc22312f592c1434577258b31c48c72d52a",
"versionType": "git"
},
{
"lessThan": "1ec8fc63e9cdb22da54e48e536c9204020416fc6",
"status": "affected",
"version": "c6790dc22312f592c1434577258b31c48c72d52a",
"versionType": "git"
},
{
"lessThan": "14469860e2e39b7095dcd658d2bad38a11110a68",
"status": "affected",
"version": "c6790dc22312f592c1434577258b31c48c72d52a",
"versionType": "git"
},
{
"lessThan": "07c33be968d9e0cab6cba38c81850a09942fcb2e",
"status": "affected",
"version": "c6790dc22312f592c1434577258b31c48c72d52a",
"versionType": "git"
},
{
"lessThan": "3bd168dd835b93a3862cd05b0d13c432b115f9d6",
"status": "affected",
"version": "c6790dc22312f592c1434577258b31c48c72d52a",
"versionType": "git"
},
{
"lessThan": "32d4c5d328a3ff995420f4f85163e1e403f43628",
"status": "affected",
"version": "c6790dc22312f592c1434577258b31c48c72d52a",
"versionType": "git"
},
{
"lessThan": "dd51a2eeb93bc6faa892ff9083911dd23f82c187",
"status": "affected",
"version": "c6790dc22312f592c1434577258b31c48c72d52a",
"versionType": "git"
},
{
"lessThan": "d21ad938398bca695a511307de38a65889e3b354",
"status": "affected",
"version": "c6790dc22312f592c1434577258b31c48c72d52a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/i915/gem/i915_gem_phys.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gem: Fix phys BO pread/pwrite with offset\n\nsg_page() returns struct page pointer not (void *) so the scaling\nof pread/pwrite is wrong for phys BO and wrong parts of BO would be\naccessed if non-zero offset is used.\n\nLast impacted platform with overlay or cursor planes using phys\nmapping was Gen3/945G/Lakeport.\n\n(cherry picked from commit 3e49a2f85070b2fb672c1e0fdba281a4ea3aebe6)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local DRM/i915 ioctls, specifically GEM pread/pwrite on a phys-backed buffer object. It is not reachable from network, adjacent, or physical device input.\nAC:L - Once on an affected legacy i915 platform with a phys-backed cursor/overlay BO, a nonzero offset reliably triggers the bad scaled pointer arithmetic. There is no race or attacker-external timing condition.\nPR:L - The attacker needs local access to the DRM device and enough ordinary DRM/KMS access to create and pin a framebuffer-backed GEM object, but not real root or CAP_SYS_ADMIN. The pread/pwrite ioctls themselves are render-allowed.\nUI:N - No victim action is required after the attacker has local DRM access. The attacker can issue the needed ioctls directly.\nS:U - The vulnerability is a kernel memory access bug reachable from a kernel driver ioctl path. It does not cross a separate security authority such as a VM host boundary.\nC:H - The faulty phys BO pread path can copy out-of-bounds kernel memory back to userspace. This is a high confidentiality impact because it can disclose kernel memory beyond the intended buffer.\nI:H - The faulty phys BO pwrite path can copy attacker-controlled data out of bounds into kernel memory relative to the coherent allocation. This is kernel memory corruption and can plausibly be leveraged for privilege escalation.\nA:H - The out-of-bounds read/write can corrupt or access invalid kernel memory and cause an oops, panic, or hang. Repeated triggering is possible through local ioctls on the affected object."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:35:05.605Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/40f738991058eb3e3530c3006a5bd6fd5e29f035"
},
{
"url": "https://git.kernel.org/stable/c/1ec8fc63e9cdb22da54e48e536c9204020416fc6"
},
{
"url": "https://git.kernel.org/stable/c/14469860e2e39b7095dcd658d2bad38a11110a68"
},
{
"url": "https://git.kernel.org/stable/c/07c33be968d9e0cab6cba38c81850a09942fcb2e"
},
{
"url": "https://git.kernel.org/stable/c/3bd168dd835b93a3862cd05b0d13c432b115f9d6"
},
{
"url": "https://git.kernel.org/stable/c/32d4c5d328a3ff995420f4f85163e1e403f43628"
},
{
"url": "https://git.kernel.org/stable/c/dd51a2eeb93bc6faa892ff9083911dd23f82c187"
},
{
"url": "https://git.kernel.org/stable/c/d21ad938398bca695a511307de38a65889e3b354"
}
],
"title": "drm/i915/gem: Fix phys BO pread/pwrite with offset",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53356",
"datePublished": "2026-07-01T13:32:31.428Z",
"dateReserved": "2026-06-09T07:44:35.400Z",
"dateUpdated": "2026-08-05T12:35:05.605Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53357 (GCVE-0-2026-53357)
Vulnerability from cvelistv5
Published
2026-07-02 13:43
Modified
2026-08-05 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
bt_accept_dequeue() unlinks a not-yet-accepted child from the parent
accept queue and release_sock()s it before returning, so the returned
sk has no caller reference and is unlocked.
l2cap_sock_cleanup_listen() walks these children on listening-socket
close. A concurrent HCI disconnect drives hci_rx_work ->
l2cap_conn_del() which runs l2cap_chan_del() + l2cap_sock_kill() and
frees the child sk and its l2cap_chan; cleanup_listen() then uses both:
BUG: KASAN: slab-use-after-free in l2cap_sock_kill
l2cap_sock_kill / l2cap_sock_cleanup_listen / __x64_sys_close
Freed by: l2cap_conn_del -> l2cap_sock_close_cb -> l2cap_sock_kill
This is distinct from the two fixes already in this area: commit
e83f5e24da741 ("Bluetooth: serialize accept_q access") serialises the
accept_q list/poll and takes temporary refs inside bt_accept_dequeue(),
and CVE-2025-39860 serialises the userspace close()/accept() race by
calling cleanup_listen() under lock_sock() in l2cap_sock_release().
Neither covers l2cap_conn_del() running from hci_rx_work, so this UAF
still reproduces on current bluetooth/master.
Take the reference at the source: bt_accept_dequeue() does sock_hold()
while sk is still locked, before release_sock(); callers sock_put().
cleanup_listen() pins the chan with l2cap_chan_hold_unless_zero() under
a brief child sk lock (serialising vs l2cap_sock_teardown_cb()), drops
it before l2cap_chan_lock(), and skips a duplicate l2cap_sock_kill() on
SOCK_DEAD. conn->lock is not taken here: cleanup_listen() runs under
the parent sk lock and that would invert
conn->lock -> chan->lock -> sk_lock (lockdep).
KASAN/SMP: an unprivileged listen/close vs HCI-disconnect race produced
12 use-after-free reports per run before this change; 0, and no lockdep
report, over 1600+ raced iterations after it on bluetooth/master.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/af_bluetooth.c",
"net/bluetooth/iso.c",
"net/bluetooth/l2cap_sock.c",
"net/bluetooth/rfcomm/sock.c",
"net/bluetooth/sco.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "751de6ec671fe75ad9cf65a0638d2a06b6a5984d",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "407217734835d21d4e0105ebf347860dc1806f88",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "7eebd4c2c86f573af87ff165d08a83432eb0b919",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "5d86d2f1b4d9a508c441d3e45277ae1a73cfed57",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "87c543e2f78d0871f271df92dab98901bbd5b6f5",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "added1213395071470a900cc845a042fb51882a6",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "a5ca86a6097a8b030ca3226cd300b17ed330f966",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "ab1513597c6cf17cd1ad2a21e3b045421b48e022",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/af_bluetooth.c",
"net/bluetooth/iso.c",
"net/bluetooth/l2cap_sock.c",
"net/bluetooth/rfcomm/sock.c",
"net/bluetooth/sco.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()\n\nbt_accept_dequeue() unlinks a not-yet-accepted child from the parent\naccept queue and release_sock()s it before returning, so the returned\nsk has no caller reference and is unlocked.\n\nl2cap_sock_cleanup_listen() walks these children on listening-socket\nclose. A concurrent HCI disconnect drives hci_rx_work -\u003e\nl2cap_conn_del() which runs l2cap_chan_del() + l2cap_sock_kill() and\nfrees the child sk and its l2cap_chan; cleanup_listen() then uses both:\n\n BUG: KASAN: slab-use-after-free in l2cap_sock_kill\n l2cap_sock_kill / l2cap_sock_cleanup_listen / __x64_sys_close\n Freed by: l2cap_conn_del -\u003e l2cap_sock_close_cb -\u003e l2cap_sock_kill\n\nThis is distinct from the two fixes already in this area: commit\ne83f5e24da741 (\"Bluetooth: serialize accept_q access\") serialises the\naccept_q list/poll and takes temporary refs inside bt_accept_dequeue(),\nand CVE-2025-39860 serialises the userspace close()/accept() race by\ncalling cleanup_listen() under lock_sock() in l2cap_sock_release().\nNeither covers l2cap_conn_del() running from hci_rx_work, so this UAF\nstill reproduces on current bluetooth/master.\n\nTake the reference at the source: bt_accept_dequeue() does sock_hold()\nwhile sk is still locked, before release_sock(); callers sock_put().\ncleanup_listen() pins the chan with l2cap_chan_hold_unless_zero() under\na brief child sk lock (serialising vs l2cap_sock_teardown_cb()), drops\nit before l2cap_chan_lock(), and skips a duplicate l2cap_sock_kill() on\nSOCK_DEAD. conn-\u003elock is not taken here: cleanup_listen() runs under\nthe parent sk lock and that would invert\nconn-\u003elock -\u003e chan-\u003elock -\u003e sk_lock (lockdep).\n\nKASAN/SMP: an unprivileged listen/close vs HCI-disconnect race produced\n12 use-after-free reports per run before this change; 0, and no lockdep\nreport, over 1600+ raced iterations after it on bluetooth/master."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The race is driven through Bluetooth L2CAP/HCI connection and disconnect handling from a nearby peer, so it is limited to Bluetooth-adjacent reachability rather than routable network access. The local listener/close side is accounted for in PR.\nAC:L - This is a race, but the attacker can reasonably control the listener close timing and the Bluetooth peer disconnect timing. The commit reports reliable unprivileged raced iterations, so no uncontrollable condition is required.\nPR:L - Creating, binding to a dynamic PSM, listening on, and closing non-raw L2CAP sockets does not require capabilities; only raw sockets or reserved PSMs need privileges. A basic unprivileged local user on the target can set up the vulnerable listener.\nUI:N - No victim user action is required once the attacker can run the unprivileged local setup and control the Bluetooth peer. The trigger is socket close racing HCI disconnect processing.\nS:U - The corruption is within the Linux kernel Bluetooth/socket subsystem and impacts the same kernel security authority. It is not a VM escape or cross-scope boundary bypass.\nC:H - The bug is a use-after-free of both the child sock and its l2cap_chan, and freed kernel heap objects can be reclaimed and used for disclosure primitives. Per kernel CVSS guidance, UAF memory corruption supports high confidentiality impact.\nI:H - The stale sock/channel pointers are used after l2cap_conn_del frees them, including through cleanup and kill paths, making heap grooming and control-flow or write-primitive exploitation plausible. Per guidance, UAF memory corruption supports high integrity impact.\nA:H - The observed failure is a KASAN slab-use-after-free in kernel Bluetooth cleanup, which can crash or oops the kernel. Repeated triggering can deny availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:35:06.665Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/751de6ec671fe75ad9cf65a0638d2a06b6a5984d"
},
{
"url": "https://git.kernel.org/stable/c/407217734835d21d4e0105ebf347860dc1806f88"
},
{
"url": "https://git.kernel.org/stable/c/7eebd4c2c86f573af87ff165d08a83432eb0b919"
},
{
"url": "https://git.kernel.org/stable/c/5d86d2f1b4d9a508c441d3e45277ae1a73cfed57"
},
{
"url": "https://git.kernel.org/stable/c/87c543e2f78d0871f271df92dab98901bbd5b6f5"
},
{
"url": "https://git.kernel.org/stable/c/added1213395071470a900cc845a042fb51882a6"
},
{
"url": "https://git.kernel.org/stable/c/a5ca86a6097a8b030ca3226cd300b17ed330f966"
},
{
"url": "https://git.kernel.org/stable/c/ab1513597c6cf17cd1ad2a21e3b045421b48e022"
}
],
"title": "Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53357",
"datePublished": "2026-07-02T13:43:17.077Z",
"dateReserved": "2026-06-09T07:44:35.400Z",
"dateUpdated": "2026-08-05T12:35:06.665Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53352 (GCVE-0-2026-53352)
Vulnerability from cvelistv5
Published
2026-07-01 13:32
Modified
2026-07-01 13:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
When a multi-threaded process receives a stop signal (e.g., SIGSTOP),
do_signal_stop() sets JOBCTL_STOP_PENDING and JOBCTL_STOP_CONSUME on all
threads and sets signal->group_stop_count to the number of threads. If
one of the threads concurrently calls execve(), de_thread() invokes
zap_other_threads() to kill all other threads. zap_other_threads()
aborts the pending group stop by resetting signal->group_stop_count to 0
and clears the JOBCTL_PENDING_MASK for all other threads. However, it
fails to clear the job control flags for the calling thread.
When execve() completes, the calling thread returns to user mode and
checks for pending signals. Seeing the stale JOBCTL_STOP_PENDING flag,
it calls do_signal_stop(), which invokes task_participate_group_stop().
Since JOBCTL_STOP_CONSUME is still set, it attempts to decrement the
already-zero signal->group_stop_count, triggering a warning:
sig->group_stop_count == 0
WARNING: CPU: 1 PID: 6475 at kernel/signal.c:373
task_participate_group_stop+0x215/0x2d0
Call Trace:
<TASK>
do_signal_stop+0x3be/0x5c0 kernel/signal.c:2619
get_signal+0xa8c/0x1330 kernel/signal.c:2884
arch_do_signal_or_restart+0xbc/0x840 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop+0x8c/0x4d0 kernel/entry/common.c:98
do_syscall_64+0x33e/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Fix this race condition by clearing the JOBCTL_PENDING_MASK for the
calling thread in zap_other_threads(), ensuring it does not retain any
stale job control state after the thread group is destroyed. This aligns
with other functions that tear down a thread group and abort group
stops, such as zap_process() and complete_signal(), which correctly
clear these flags for all threads including the current one.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 39efa3ef3a376a4e53de2f82fc91182459d34200 Version: 39efa3ef3a376a4e53de2f82fc91182459d34200 Version: 39efa3ef3a376a4e53de2f82fc91182459d34200 Version: 39efa3ef3a376a4e53de2f82fc91182459d34200 Version: 39efa3ef3a376a4e53de2f82fc91182459d34200 Version: 39efa3ef3a376a4e53de2f82fc91182459d34200 Version: 39efa3ef3a376a4e53de2f82fc91182459d34200 Version: 39efa3ef3a376a4e53de2f82fc91182459d34200 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/signal.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2b32b2fb241435145ea199efac024540759d2495",
"status": "affected",
"version": "39efa3ef3a376a4e53de2f82fc91182459d34200",
"versionType": "git"
},
{
"lessThan": "391ebe74456a0f1d60b3ba4a8a64d9f44c1728fe",
"status": "affected",
"version": "39efa3ef3a376a4e53de2f82fc91182459d34200",
"versionType": "git"
},
{
"lessThan": "f8d720bc2e35d568c18be0644e92a468de428370",
"status": "affected",
"version": "39efa3ef3a376a4e53de2f82fc91182459d34200",
"versionType": "git"
},
{
"lessThan": "f4aae11abb449dc536269705d0419ec69480faa9",
"status": "affected",
"version": "39efa3ef3a376a4e53de2f82fc91182459d34200",
"versionType": "git"
},
{
"lessThan": "76aebd9ef20078719dfd6282d3b06c27e900a65a",
"status": "affected",
"version": "39efa3ef3a376a4e53de2f82fc91182459d34200",
"versionType": "git"
},
{
"lessThan": "8c046f36222c6ce1e0daef2c45c891c72602f8a1",
"status": "affected",
"version": "39efa3ef3a376a4e53de2f82fc91182459d34200",
"versionType": "git"
},
{
"lessThan": "dfcd0ba14769d94d76ac9d9814b85e7fcacd4e29",
"status": "affected",
"version": "39efa3ef3a376a4e53de2f82fc91182459d34200",
"versionType": "git"
},
{
"lessThan": "90918794a4e2c3b440f8fcf3847765a8b1d81b25",
"status": "affected",
"version": "39efa3ef3a376a4e53de2f82fc91182459d34200",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/signal.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.0"
},
{
"lessThan": "3.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsignal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()\n\nWhen a multi-threaded process receives a stop signal (e.g., SIGSTOP),\ndo_signal_stop() sets JOBCTL_STOP_PENDING and JOBCTL_STOP_CONSUME on all\nthreads and sets signal-\u003egroup_stop_count to the number of threads. If\none of the threads concurrently calls execve(), de_thread() invokes\nzap_other_threads() to kill all other threads. zap_other_threads()\naborts the pending group stop by resetting signal-\u003egroup_stop_count to 0\nand clears the JOBCTL_PENDING_MASK for all other threads. However, it\nfails to clear the job control flags for the calling thread.\n\nWhen execve() completes, the calling thread returns to user mode and\nchecks for pending signals. Seeing the stale JOBCTL_STOP_PENDING flag,\nit calls do_signal_stop(), which invokes task_participate_group_stop().\nSince JOBCTL_STOP_CONSUME is still set, it attempts to decrement the\nalready-zero signal-\u003egroup_stop_count, triggering a warning:\n\nsig-\u003egroup_stop_count == 0\nWARNING: CPU: 1 PID: 6475 at kernel/signal.c:373\ntask_participate_group_stop+0x215/0x2d0\nCall Trace:\n \u003cTASK\u003e\n do_signal_stop+0x3be/0x5c0 kernel/signal.c:2619\n get_signal+0xa8c/0x1330 kernel/signal.c:2884\n arch_do_signal_or_restart+0xbc/0x840 arch/x86/kernel/signal.c:337\n exit_to_user_mode_loop+0x8c/0x4d0 kernel/entry/common.c:98\n do_syscall_64+0x33e/0xf80 arch/x86/entry/syscall_64.c:100\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e\n\nFix this race condition by clearing the JOBCTL_PENDING_MASK for the\ncalling thread in zap_other_threads(), ensuring it does not retain any\nstale job control state after the thread group is destroyed. This aligns\nwith other functions that tear down a thread group and abort group\nstops, such as zap_process() and complete_signal(), which correctly\nclear these flags for all threads including the current one."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T13:32:29.105Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2b32b2fb241435145ea199efac024540759d2495"
},
{
"url": "https://git.kernel.org/stable/c/391ebe74456a0f1d60b3ba4a8a64d9f44c1728fe"
},
{
"url": "https://git.kernel.org/stable/c/f8d720bc2e35d568c18be0644e92a468de428370"
},
{
"url": "https://git.kernel.org/stable/c/f4aae11abb449dc536269705d0419ec69480faa9"
},
{
"url": "https://git.kernel.org/stable/c/76aebd9ef20078719dfd6282d3b06c27e900a65a"
},
{
"url": "https://git.kernel.org/stable/c/8c046f36222c6ce1e0daef2c45c891c72602f8a1"
},
{
"url": "https://git.kernel.org/stable/c/dfcd0ba14769d94d76ac9d9814b85e7fcacd4e29"
},
{
"url": "https://git.kernel.org/stable/c/90918794a4e2c3b440f8fcf3847765a8b1d81b25"
}
],
"title": "signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53352",
"datePublished": "2026-07-01T13:32:29.105Z",
"dateReserved": "2026-06-09T07:44:35.400Z",
"dateUpdated": "2026-07-01T13:32:29.105Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53012 (GCVE-0-2026-53012)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-06-24 16:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nexthop: fix IPv6 route referencing IPv4 nexthop
syzbot reported a panic [1] [2].
When an IPv6 nexthop is replaced with an IPv4 nexthop, the has_v4 flag
of all groups containing this nexthop is not updated. This is because
nh_group_v4_update is only called when replacing AF_INET to AF_INET6,
but the reverse direction (AF_INET6 to AF_INET) is missed.
This allows a stale has_v4=false to bypass fib6_check_nexthop, causing
IPv6 routes to be attached to groups that effectively contain only AF_INET
members. Subsequent route lookups then call nexthop_fib6_nh() which
returns NULL for the AF_INET member, leading to a NULL pointer
dereference.
Fix by calling nh_group_v4_update whenever the family changes, not just
AF_INET to AF_INET6.
Reproducer:
# AF_INET6 blackhole
ip -6 nexthop add id 1 blackhole
# group with has_v4=false
ip nexthop add id 100 group 1
# replace with AF_INET (no -6), has_v4 stays false
ip nexthop replace id 1 blackhole
# pass stale has_v4 check
ip -6 route add 2001:db8::/64 nhid 100
# panic
ping -6 2001:db8::1
[1] https://syzkaller.appspot.com/bug?id=e17283eb2f8dcf3dd9b47fe6f67a95f71faadad0
[2] https://syzkaller.appspot.com/bug?id=8699b6ae54c9f35837d925686208402949e12ef3
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7bf4796dd09984ad1612877a82d0d139c70ae27f Version: 7bf4796dd09984ad1612877a82d0d139c70ae27f Version: 7bf4796dd09984ad1612877a82d0d139c70ae27f Version: 7bf4796dd09984ad1612877a82d0d139c70ae27f Version: 7bf4796dd09984ad1612877a82d0d139c70ae27f Version: 7bf4796dd09984ad1612877a82d0d139c70ae27f Version: 7bf4796dd09984ad1612877a82d0d139c70ae27f Version: 7bf4796dd09984ad1612877a82d0d139c70ae27f |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/nexthop.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ceffe81a0be92afc0cd1340bc8ca46559cce9bb4",
"status": "affected",
"version": "7bf4796dd09984ad1612877a82d0d139c70ae27f",
"versionType": "git"
},
{
"lessThan": "9c2d6770a5f4545a307eb66979bef7656a34d621",
"status": "affected",
"version": "7bf4796dd09984ad1612877a82d0d139c70ae27f",
"versionType": "git"
},
{
"lessThan": "6275796f22bb382f3e9aa58ed0b4ef7bdad78cb8",
"status": "affected",
"version": "7bf4796dd09984ad1612877a82d0d139c70ae27f",
"versionType": "git"
},
{
"lessThan": "aaac3bed034239e1d75732211d9b05f30b0b4f35",
"status": "affected",
"version": "7bf4796dd09984ad1612877a82d0d139c70ae27f",
"versionType": "git"
},
{
"lessThan": "ad85961004fd4bd2f31209ac4b07612c6cefb9e7",
"status": "affected",
"version": "7bf4796dd09984ad1612877a82d0d139c70ae27f",
"versionType": "git"
},
{
"lessThan": "613c8f4a501421dd258b07ea614205d4e16ec845",
"status": "affected",
"version": "7bf4796dd09984ad1612877a82d0d139c70ae27f",
"versionType": "git"
},
{
"lessThan": "b3b7e850e1541f0520c4a12ec884255c30427ff6",
"status": "affected",
"version": "7bf4796dd09984ad1612877a82d0d139c70ae27f",
"versionType": "git"
},
{
"lessThan": "29c95185ba32b621fbc3800fb86e7dc3edf5c2be",
"status": "affected",
"version": "7bf4796dd09984ad1612877a82d0d139c70ae27f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/nexthop.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnexthop: fix IPv6 route referencing IPv4 nexthop\n\nsyzbot reported a panic [1] [2].\n\nWhen an IPv6 nexthop is replaced with an IPv4 nexthop, the has_v4 flag\nof all groups containing this nexthop is not updated. This is because\nnh_group_v4_update is only called when replacing AF_INET to AF_INET6,\nbut the reverse direction (AF_INET6 to AF_INET) is missed.\n\nThis allows a stale has_v4=false to bypass fib6_check_nexthop, causing\nIPv6 routes to be attached to groups that effectively contain only AF_INET\nmembers. Subsequent route lookups then call nexthop_fib6_nh() which\nreturns NULL for the AF_INET member, leading to a NULL pointer\ndereference.\n\nFix by calling nh_group_v4_update whenever the family changes, not just\nAF_INET to AF_INET6.\n\nReproducer:\n\t# AF_INET6 blackhole\n\tip -6 nexthop add id 1 blackhole\n\t# group with has_v4=false\n\tip nexthop add id 100 group 1\n\t# replace with AF_INET (no -6), has_v4 stays false\n\tip nexthop replace id 1 blackhole\n\t# pass stale has_v4 check\n\tip -6 route add 2001:db8::/64 nhid 100\n\t# panic\n\tping -6 2001:db8::1\n\n[1] https://syzkaller.appspot.com/bug?id=e17283eb2f8dcf3dd9b47fe6f67a95f71faadad0\n[2] https://syzkaller.appspot.com/bug?id=8699b6ae54c9f35837d925686208402949e12ef3"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:29:22.973Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ceffe81a0be92afc0cd1340bc8ca46559cce9bb4"
},
{
"url": "https://git.kernel.org/stable/c/9c2d6770a5f4545a307eb66979bef7656a34d621"
},
{
"url": "https://git.kernel.org/stable/c/6275796f22bb382f3e9aa58ed0b4ef7bdad78cb8"
},
{
"url": "https://git.kernel.org/stable/c/aaac3bed034239e1d75732211d9b05f30b0b4f35"
},
{
"url": "https://git.kernel.org/stable/c/ad85961004fd4bd2f31209ac4b07612c6cefb9e7"
},
{
"url": "https://git.kernel.org/stable/c/613c8f4a501421dd258b07ea614205d4e16ec845"
},
{
"url": "https://git.kernel.org/stable/c/b3b7e850e1541f0520c4a12ec884255c30427ff6"
},
{
"url": "https://git.kernel.org/stable/c/29c95185ba32b621fbc3800fb86e7dc3edf5c2be"
}
],
"title": "nexthop: fix IPv6 route referencing IPv4 nexthop",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53012",
"datePublished": "2026-06-24T16:29:22.973Z",
"dateReserved": "2026-06-09T07:44:35.378Z",
"dateUpdated": "2026-06-24T16:29:22.973Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42055 (GCVE-0-2026-42055)
Vulnerability from cvelistv5
Published
2026-06-17 14:04
Modified
2026-08-25 12:05
Severity ?
8.1 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
9.2 (Critical) - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
9.2 (Critical) - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
VLAI Severity ?
EPSS score ?
CWE
- CWE-122 - Heap-based Buffer Overflow
Summary
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| F5 | NGINX Open Source |
Version: 1.13.10 < 1.31.2 Version: 1.30.2 < 1.30.3 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42055",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-17T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-18T03:57:46.697Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
],
"defaultStatus": "affected",
"packageName": "odf4/odf-console-rhel9",
"product": "Red Hat Openshift Data Foundation 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:discovery:2::el9"
],
"defaultStatus": "unaffected",
"packageName": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:0c4f21c943641c8b229a8f018be12cb4a833ab5acd02b3bebc427bfb47635f47_arm64",
"product": "Red Hat Discovery 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:rhui:5::el9"
],
"defaultStatus": "unaffected",
"packageName": "registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"product": "Red Hat Update Infrastructure 5",
"vendor": "Red Hat"
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
],
"defaultStatus": "unaffected",
"packageName": "odf4/ocs-client-console-rhel9",
"product": "Red Hat Openshift Data Foundation 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "unaffected",
"packageName": "nginx-2:1.26.3-6.el10_2.5.aarch64",
"product": "Red Hat Enterprise Linux AppStream (v. 10)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream"
],
"defaultStatus": "unaffected",
"packageName": "nginx-1:1.24.0-3.module+el8.10.0+24503+61c7c092.3.aarch64 (nginx:1.24)",
"product": "Red Hat Enterprise Linux AppStream (v. 8)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
],
"defaultStatus": "unaffected",
"packageName": "nginx-1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3.aarch64 (nginx:1.24)",
"product": "Red Hat Enterprise Linux AppStream (v. 9)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "unaffected",
"packageName": "nginx-debugsource-2:1.26.3-6.el10_2.5.aarch64",
"product": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::crb"
],
"defaultStatus": "unaffected",
"packageName": "nginx-debugsource-2:1.20.1-28.el9_8.4.aarch64",
"product": "Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "unaffected",
"packageName": "nginx-main@aarch64",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-17T14:04:32.520Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in NGINX. When NGINX is configured to proxy HTTP/2 traffic using the ngx_http_proxy_v2_module or ngx_http_grpc_module with specific settings, a remote, unauthenticated attacker can send specially crafted large headers. This can trigger a heap-based buffer overflow, leading to a restart of the NGINX worker process and a Denial of Service (DoS). Under certain conditions, such as when Address Space Layout Randomization (ASLR) is disabled or bypassed, this vulnerability could also allow for arbitrary code execution."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-131",
"description": "Incorrect Calculation of Buffer Size",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T12:05:38.426Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-42055"
},
{
"name": "RHBZ#2489866",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489866"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42055.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36364"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:38847"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36618"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36331"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36639"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:46836"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27197"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:58981"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:36364: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:38847: Red Hat Enterprise Linux AppStream (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:36618: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:36331: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:36639: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:46836: Red Hat Discovery 2"
},
{
"lang": "en",
"value": "RHSA-2026:27197: Red Hat Hardened Images"
},
{
"lang": "en",
"value": "RHSA-2026:44481: Red Hat Update Infrastructure 5"
},
{
"lang": "en",
"value": "RHSA-2026:58981: Red Hat Update Infrastructure 5"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-17T16:01:41.848Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-17T14:04:32.520Z",
"value": "Made public."
}
],
"title": "nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this vulnerability, ensure that the `ignore_invalid_headers` directive is set to `on` in your NGINX configuration, or reduce the size specified by the `large_client_header_buffers` directive to 2 megabytes or less. These changes require an NGINX service reload or restart to take effect. Reloading the NGINX service is generally safe, but a restart will briefly interrupt service."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"modules": [
"ngx_http_proxy_v2_module",
"ngx_http_grpc_module"
],
"product": "NGINX Open Source",
"vendor": "F5",
"versions": [
{
"lessThan": "1.31.2",
"status": "affected",
"version": "1.13.10",
"versionType": "custom"
},
{
"lessThan": "1.30.3",
"status": "affected",
"version": "1.30.2",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"ngx_http_proxy_v2_module",
"ngx_http_grpc_module"
],
"product": "NGINX Plus",
"vendor": "F5",
"versions": [
{
"lessThan": "37.0.2.1",
"status": "affected",
"version": "37.0",
"versionType": "custom"
},
{
"lessThan": "R36 P6",
"status": "affected",
"version": "R36",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "\"F5 acknowledges Mufeed VH of Winfunc Research, Trung Nguyen (@everping) of CyStack, Feng Xue and XGPT of ThreatBook, Hcamael and \u7ae0\u9c7c\u54e5 of aipyapp, and Zhen Yan (AntAISecurityLab) for bringing this issue to our attention and following the highest standards of coordinated disclosure.\""
}
],
"datePublic": "2026-06-17T14:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eNGINX Plus and NGINX Open Source have a vulnerability in the \u003c/span\u003e\u003cstrong\u003engx_http_proxy_v2_module\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;and \u003c/span\u003e\u003cstrong\u003engx_http_grpc_module\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;modules. This vulnerability exists when the \u003c/span\u003e\u003cstrong\u003eproxy_http_version to 2\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;or \u003c/span\u003e\u003cstrong\u003egrpc_pass\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;directives are used to proxy HTTP/2 traffic, the \u003c/span\u003e\u003cstrong\u003eignore_invalid_headers\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;directive is set to off, and the \u003c/span\u003e\u003cstrong\u003elarge_client_header_buffers\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\u003c/span\u003e \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
}
],
"value": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module\u00a0and ngx_http_grpc_module\u00a0modules. This vulnerability exists when the proxy_http_version to 2\u00a0or grpc_pass\u00a0directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers\u00a0directive is set to off, and the large_client_header_buffers\u00a0directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-17T14:04:32.520Z",
"orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
"shortName": "f5"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://my.f5.com/manage/s/article/K000161584"
}
],
"source": {
"discovery": "EXTERNAL"
},
"tags": [
"x_F5"
],
"title": "NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability",
"x_generator": {
"engine": "F5 SIRTBot v1.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
"assignerShortName": "f5",
"cveId": "CVE-2026-42055",
"datePublished": "2026-06-17T14:04:32.520Z",
"dateReserved": "2026-06-02T21:45:04.818Z",
"dateUpdated": "2026-08-25T12:05:38.426Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53337 (GCVE-0-2026-53337)
Vulnerability from cvelistv5
Published
2026-07-01 13:32
Modified
2026-07-01 13:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: bonding: fix NULL pointer dereference in bond_do_ioctl()
In bond_do_ioctl(), slave_dev is obtained via __dev_get_by_name() which
can return NULL if the requested interface name does not exist. However,
the subsequent slave_dbg() call is placed before the NULL check:
slave_dev = __dev_get_by_name(net, ifr->ifr_slave);
slave_dbg(bond_dev, slave_dev, "slave_dev=%p:\n", slave_dev); //here
if (!slave_dev)
return -ENODEV;
The slave_dbg() macro expands to netdev_dbg(bond_dev, "(slave %s): " fmt,
(slave_dev)->name, ...) which unconditionally dereferences slave_dev->name
before the NULL check is performed. This results in a NULL pointer
dereference kernel oops when a user calls bonding ioctl (e.g.
SIOCBONDENSLAVE, SIOCBONDRELEASE, etc.) with a non-existent slave
interface name.
This is reachable from userspace via the bonding ioctl interface with
CAP_NET_ADMIN capability, making it a potential local denial-of-service
vector.
Fix by moving the slave_dbg() call after the NULL check.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e2a7420df2e01370b40e4cf7b85ab9a885c6d755 Version: e2a7420df2e01370b40e4cf7b85ab9a885c6d755 Version: e2a7420df2e01370b40e4cf7b85ab9a885c6d755 Version: e2a7420df2e01370b40e4cf7b85ab9a885c6d755 Version: e2a7420df2e01370b40e4cf7b85ab9a885c6d755 Version: e2a7420df2e01370b40e4cf7b85ab9a885c6d755 Version: e2a7420df2e01370b40e4cf7b85ab9a885c6d755 Version: e2a7420df2e01370b40e4cf7b85ab9a885c6d755 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/bonding/bond_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1b7558c85493467b2ea20738866b822db6442034",
"status": "affected",
"version": "e2a7420df2e01370b40e4cf7b85ab9a885c6d755",
"versionType": "git"
},
{
"lessThan": "b02b2e3e876c18733b868a29064abd11cdbf8feb",
"status": "affected",
"version": "e2a7420df2e01370b40e4cf7b85ab9a885c6d755",
"versionType": "git"
},
{
"lessThan": "66693957bacd1c9dae6188a7312d6be69a221f2d",
"status": "affected",
"version": "e2a7420df2e01370b40e4cf7b85ab9a885c6d755",
"versionType": "git"
},
{
"lessThan": "a629418d463fb50d132a1aa063b0105857311e5f",
"status": "affected",
"version": "e2a7420df2e01370b40e4cf7b85ab9a885c6d755",
"versionType": "git"
},
{
"lessThan": "c2cfe290fdb1c32a4f4eb2b8ca3f363b305d21ba",
"status": "affected",
"version": "e2a7420df2e01370b40e4cf7b85ab9a885c6d755",
"versionType": "git"
},
{
"lessThan": "bcb8fad90f27300add583a8371db504b766d95c7",
"status": "affected",
"version": "e2a7420df2e01370b40e4cf7b85ab9a885c6d755",
"versionType": "git"
},
{
"lessThan": "b0878106ddc486375084145848ff255dedfff46a",
"status": "affected",
"version": "e2a7420df2e01370b40e4cf7b85ab9a885c6d755",
"versionType": "git"
},
{
"lessThan": "a764b0e8317a863006e05732e1aefe821b9d8c2d",
"status": "affected",
"version": "e2a7420df2e01370b40e4cf7b85ab9a885c6d755",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/bonding/bond_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bonding: fix NULL pointer dereference in bond_do_ioctl()\n\nIn bond_do_ioctl(), slave_dev is obtained via __dev_get_by_name() which\ncan return NULL if the requested interface name does not exist. However,\nthe subsequent slave_dbg() call is placed before the NULL check:\n\n slave_dev = __dev_get_by_name(net, ifr-\u003eifr_slave);\n slave_dbg(bond_dev, slave_dev, \"slave_dev=%p:\\n\", slave_dev); //here\n if (!slave_dev)\n return -ENODEV;\n\nThe slave_dbg() macro expands to netdev_dbg(bond_dev, \"(slave %s): \" fmt,\n(slave_dev)-\u003ename, ...) which unconditionally dereferences slave_dev-\u003ename\nbefore the NULL check is performed. This results in a NULL pointer\ndereference kernel oops when a user calls bonding ioctl (e.g.\nSIOCBONDENSLAVE, SIOCBONDRELEASE, etc.) with a non-existent slave\ninterface name.\n\nThis is reachable from userspace via the bonding ioctl interface with\nCAP_NET_ADMIN capability, making it a potential local denial-of-service\nvector.\n\nFix by moving the slave_dbg() call after the NULL check."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T13:32:19.046Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1b7558c85493467b2ea20738866b822db6442034"
},
{
"url": "https://git.kernel.org/stable/c/b02b2e3e876c18733b868a29064abd11cdbf8feb"
},
{
"url": "https://git.kernel.org/stable/c/66693957bacd1c9dae6188a7312d6be69a221f2d"
},
{
"url": "https://git.kernel.org/stable/c/a629418d463fb50d132a1aa063b0105857311e5f"
},
{
"url": "https://git.kernel.org/stable/c/c2cfe290fdb1c32a4f4eb2b8ca3f363b305d21ba"
},
{
"url": "https://git.kernel.org/stable/c/bcb8fad90f27300add583a8371db504b766d95c7"
},
{
"url": "https://git.kernel.org/stable/c/b0878106ddc486375084145848ff255dedfff46a"
},
{
"url": "https://git.kernel.org/stable/c/a764b0e8317a863006e05732e1aefe821b9d8c2d"
}
],
"title": "net: bonding: fix NULL pointer dereference in bond_do_ioctl()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53337",
"datePublished": "2026-07-01T13:32:19.046Z",
"dateReserved": "2026-06-09T07:44:35.399Z",
"dateUpdated": "2026-07-01T13:32:19.046Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53077 (GCVE-0-2026-53077)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/rds: Restrict use of RDS/IB to the initial network namespace
Prevent using RDS/IB in network namespaces other than the initial one.
The existing RDS/IB code will not work properly in non-initial network
namespaces.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638 Version: d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638 Version: d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638 Version: d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638 Version: d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638 Version: d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638 Version: d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638 Version: d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/rds/af_rds.c",
"net/rds/ib.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3e7f14cd5a51533404e1ae4809caab46073fb5c7",
"status": "affected",
"version": "d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638",
"versionType": "git"
},
{
"lessThan": "3174fc703d081d2ca538b22fba734e3ad5b52322",
"status": "affected",
"version": "d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638",
"versionType": "git"
},
{
"lessThan": "c244b79adffad89a5173cf8bfaa06a6b40bbd09b",
"status": "affected",
"version": "d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638",
"versionType": "git"
},
{
"lessThan": "07035306bf722f4676a1aee35cbeb3732c76194e",
"status": "affected",
"version": "d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638",
"versionType": "git"
},
{
"lessThan": "fb407343c0c16e94584707b2dfdd350a5f81b000",
"status": "affected",
"version": "d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638",
"versionType": "git"
},
{
"lessThan": "a7494479757d60d2413bfaa087f8431a26eea032",
"status": "affected",
"version": "d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638",
"versionType": "git"
},
{
"lessThan": "b6a54f5e9ce9b97ae641855378d71c5154a085c0",
"status": "affected",
"version": "d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638",
"versionType": "git"
},
{
"lessThan": "ebf71dd4aff46e8e421d455db3e231ba43d2fa8a",
"status": "affected",
"version": "d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/rds/af_rds.c",
"net/rds/ib.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.3"
},
{
"lessThan": "4.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: Restrict use of RDS/IB to the initial network namespace\n\nPrevent using RDS/IB in network namespaces other than the initial one.\nThe existing RDS/IB code will not work properly in non-initial network\nnamespaces."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Reachability is through local syscalls: unshare a user/network namespace, create an AF_RDS socket, select RDS/IB with setsockopt, then bind/send and tear down the namespace. A remote peer alone cannot create the stale non-init namespace RDS/IB connection.\nAC:L - The attacker controls the namespace lifetime and socket operations needed to leave an RDS/IB connection with a stale net pointer, and syzbot reproduced the UAF. No hard-to-win race or victim state outside attacker control is required.\nPR:L - AF_RDS socket creation and SO_RDS_TRANSPORT do not require real init-namespace root, and the issue is reachable by an unprivileged local user via user namespaces. This is not an unauthenticated remote path, so low local privileges are required.\nUI:N - No victim action is needed after the attacker runs the local namespace and socket sequence. The later RDMA/RDS workqueue access occurs asynchronously in kernel context.\nS:U - The vulnerability corrupts/accesses kernel resources within the same kernel security authority. It is not a VM escape, IOMMU bypass, or other cross-authority boundary break.\nC:H - The bug is a slab use-after-free read of a freed net_namespace from RDS/IB asynchronous connection handling. Under the required kernel scoring guidance, UAFs are scored as high confidentiality impact because freed object reuse can expose kernel memory.\nI:H - Although the observed report is a UAF read, use-after-free bugs can generally be shaped through heap reuse into stronger memory corruption primitives. Per the required guidance and uncertainty rule, this warrants high integrity impact.\nA:H - Syzbot reports a KASAN slab-use-after-free in rds_conn_path_drop, and the same stale pointer access can trigger kernel oops/panic or destabilize RDS/RDMA workqueues. Kernel crash availability impact is high."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:10.122Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3e7f14cd5a51533404e1ae4809caab46073fb5c7"
},
{
"url": "https://git.kernel.org/stable/c/3174fc703d081d2ca538b22fba734e3ad5b52322"
},
{
"url": "https://git.kernel.org/stable/c/c244b79adffad89a5173cf8bfaa06a6b40bbd09b"
},
{
"url": "https://git.kernel.org/stable/c/07035306bf722f4676a1aee35cbeb3732c76194e"
},
{
"url": "https://git.kernel.org/stable/c/fb407343c0c16e94584707b2dfdd350a5f81b000"
},
{
"url": "https://git.kernel.org/stable/c/a7494479757d60d2413bfaa087f8431a26eea032"
},
{
"url": "https://git.kernel.org/stable/c/b6a54f5e9ce9b97ae641855378d71c5154a085c0"
},
{
"url": "https://git.kernel.org/stable/c/ebf71dd4aff46e8e421d455db3e231ba43d2fa8a"
}
],
"title": "net/rds: Restrict use of RDS/IB to the initial network namespace",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53077",
"datePublished": "2026-06-24T16:30:17.972Z",
"dateReserved": "2026-06-09T07:44:35.383Z",
"dateUpdated": "2026-08-05T12:33:10.122Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53349 (GCVE-0-2026-53349)
Vulnerability from cvelistv5
Published
2026-07-01 13:32
Modified
2026-07-01 13:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack: destroy stale expectfn expectations on unregister
NAT helpers such as nf_nat_h323 store a raw pointer to module text in
exp->expectfn (e.g. ip_nat_q931_expect). nf_ct_helper_expectfn_unregister()
only unlinks the callback descriptor and never walks the expectation table,
so an expectation pending at module removal survives with a dangling
exp->expectfn into freed module text.
When the expected connection arrives, init_conntrack() invokes
exp->expectfn(), now a stale pointer into the unloaded module. Reproduced
on a KASAN build by loading the H.323 helpers, creating a Q.931
expectation, unloading nf_nat_h323, then connecting to the expected port:
Oops: int3: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:0xffffffffa06102d1
init_conntrack.isra.0 (net/netfilter/nf_conntrack_core.c:1862)
nf_conntrack_in (net/netfilter/nf_conntrack_core.c:2049)
ipv4_conntrack_local (net/netfilter/nf_conntrack_proto.c:223)
nf_hook_slow (net/netfilter/core.c:619)
__ip_local_out (net/ipv4/ip_output.c:120)
__tcp_transmit_skb (net/ipv4/tcp_output.c:1715)
tcp_connect (net/ipv4/tcp_output.c:4374)
tcp_v4_connect (net/ipv4/tcp_ipv4.c:345)
__sys_connect (net/socket.c:2167)
Modules linked in: nf_conntrack_h323 [last unloaded: nf_nat_h323]
Reaching the dangling state requires CAP_SYS_MODULE in the initial user
namespace to remove a NAT helper that still has live expectations, so this
is a robustness fix; leaving an expectation pointing at freed text is wrong
regardless.
Add nf_ct_helper_expectfn_destroy(), which walks the expectation table and
drops every expectation whose ->expectfn matches the descriptor being torn
down. Call it from each NAT helper's exit path after the existing RCU grace
period, so no expectation outlives the code it points at and no extra
synchronize_rcu() is introduced. With the fix, the same reproducer runs to
completion without the Oops.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4 Version: f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4 Version: f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4 Version: f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4 Version: f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4 Version: f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/netfilter/nf_conntrack_helper.h",
"net/ipv4/netfilter/nf_nat_h323.c",
"net/netfilter/nf_conntrack_helper.c",
"net/netfilter/nf_nat_core.c",
"net/netfilter/nf_nat_sip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fbfde85308b99938a6092c48753214d190ece48d",
"status": "affected",
"version": "f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4",
"versionType": "git"
},
{
"lessThan": "29d8cc44bbdf7b83a1929912214afe6643c1b4f1",
"status": "affected",
"version": "f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4",
"versionType": "git"
},
{
"lessThan": "f92c90a2a3e6ff6f9f7fe88fde9004b4ca8f956d",
"status": "affected",
"version": "f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4",
"versionType": "git"
},
{
"lessThan": "9d017671dcfcec23321fb7962dea624f9e71ddb1",
"status": "affected",
"version": "f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4",
"versionType": "git"
},
{
"lessThan": "bf8c0b5dd203be94c2ad50e264cec19267c6bd39",
"status": "affected",
"version": "f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4",
"versionType": "git"
},
{
"lessThan": "c3009418f9fa1dcb3eb86f4d8c92583537b5faa3",
"status": "affected",
"version": "f587de0e2feb9eb9b94f98d0a7b7437e4d6617b4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/netfilter/nf_conntrack_helper.h",
"net/ipv4/netfilter/nf_nat_h323.c",
"net/netfilter/nf_conntrack_helper.c",
"net/netfilter/nf_nat_core.c",
"net/netfilter/nf_nat_sip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.20"
},
{
"lessThan": "2.6.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack: destroy stale expectfn expectations on unregister\n\nNAT helpers such as nf_nat_h323 store a raw pointer to module text in\nexp-\u003eexpectfn (e.g. ip_nat_q931_expect). nf_ct_helper_expectfn_unregister()\nonly unlinks the callback descriptor and never walks the expectation table,\nso an expectation pending at module removal survives with a dangling\nexp-\u003eexpectfn into freed module text.\n\nWhen the expected connection arrives, init_conntrack() invokes\nexp-\u003eexpectfn(), now a stale pointer into the unloaded module. Reproduced\non a KASAN build by loading the H.323 helpers, creating a Q.931\nexpectation, unloading nf_nat_h323, then connecting to the expected port:\n\n Oops: int3: 0000 [#1] SMP KASAN NOPTI\n RIP: 0010:0xffffffffa06102d1\n init_conntrack.isra.0 (net/netfilter/nf_conntrack_core.c:1862)\n nf_conntrack_in (net/netfilter/nf_conntrack_core.c:2049)\n ipv4_conntrack_local (net/netfilter/nf_conntrack_proto.c:223)\n nf_hook_slow (net/netfilter/core.c:619)\n __ip_local_out (net/ipv4/ip_output.c:120)\n __tcp_transmit_skb (net/ipv4/tcp_output.c:1715)\n tcp_connect (net/ipv4/tcp_output.c:4374)\n tcp_v4_connect (net/ipv4/tcp_ipv4.c:345)\n __sys_connect (net/socket.c:2167)\n Modules linked in: nf_conntrack_h323 [last unloaded: nf_nat_h323]\n\nReaching the dangling state requires CAP_SYS_MODULE in the initial user\nnamespace to remove a NAT helper that still has live expectations, so this\nis a robustness fix; leaving an expectation pointing at freed text is wrong\nregardless.\n\nAdd nf_ct_helper_expectfn_destroy(), which walks the expectation table and\ndrops every expectation whose -\u003eexpectfn matches the descriptor being torn\ndown. Call it from each NAT helper\u0027s exit path after the existing RCU grace\nperiod, so no expectation outlives the code it points at and no extra\nsynchronize_rcu() is introduced. With the fix, the same reproducer runs to\ncompletion without the Oops."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T13:32:27.412Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fbfde85308b99938a6092c48753214d190ece48d"
},
{
"url": "https://git.kernel.org/stable/c/29d8cc44bbdf7b83a1929912214afe6643c1b4f1"
},
{
"url": "https://git.kernel.org/stable/c/f92c90a2a3e6ff6f9f7fe88fde9004b4ca8f956d"
},
{
"url": "https://git.kernel.org/stable/c/9d017671dcfcec23321fb7962dea624f9e71ddb1"
},
{
"url": "https://git.kernel.org/stable/c/bf8c0b5dd203be94c2ad50e264cec19267c6bd39"
},
{
"url": "https://git.kernel.org/stable/c/c3009418f9fa1dcb3eb86f4d8c92583537b5faa3"
}
],
"title": "netfilter: nf_conntrack: destroy stale expectfn expectations on unregister",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53349",
"datePublished": "2026-07-01T13:32:27.412Z",
"dateReserved": "2026-06-09T07:44:35.399Z",
"dateUpdated": "2026-07-01T13:32:27.412Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52967 (GCVE-0-2026-52967)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb/client: fix possible infinite loop and oob read in symlink_data()
On 32-bit architectures, the infinite loop is as follows:
len = p->ErrorDataLength == 0xfffffff8
u8 *next = p->ErrorContextData + len
next == p
On 32-bit architectures, the out-of-bounds read is as follows:
len = p->ErrorDataLength == 0xfffffff0
u8 *next = p->ErrorContextData + len
next == (u8 *)p - 8
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 76894f3e2f71177747b8b4763fb180e800279585 Version: 76894f3e2f71177747b8b4763fb180e800279585 Version: 76894f3e2f71177747b8b4763fb180e800279585 Version: 76894f3e2f71177747b8b4763fb180e800279585 Version: 76894f3e2f71177747b8b4763fb180e800279585 Version: 76894f3e2f71177747b8b4763fb180e800279585 Version: 2d046892a493d9760c35fdaefc3017f27f91b621 Version: 6.0.16 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2file.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1cfa2d59f669db28d6292d10ff87ca6837c781b0",
"status": "affected",
"version": "76894f3e2f71177747b8b4763fb180e800279585",
"versionType": "git"
},
{
"lessThan": "b41598bf54b3fe528994e573df6008f8f4d0a4f4",
"status": "affected",
"version": "76894f3e2f71177747b8b4763fb180e800279585",
"versionType": "git"
},
{
"lessThan": "cd4b9b662f0fb9aa97ee6bf9034eca76fc6cab23",
"status": "affected",
"version": "76894f3e2f71177747b8b4763fb180e800279585",
"versionType": "git"
},
{
"lessThan": "97a05b0ae9ea5ec052be2eef0f9cc7ce03501bbb",
"status": "affected",
"version": "76894f3e2f71177747b8b4763fb180e800279585",
"versionType": "git"
},
{
"lessThan": "1b9331b16b0ed9414dcf7583d8134bdfeb117aae",
"status": "affected",
"version": "76894f3e2f71177747b8b4763fb180e800279585",
"versionType": "git"
},
{
"lessThan": "7d9a7f1f96cd617ee9e75bb22217c709038e26b8",
"status": "affected",
"version": "76894f3e2f71177747b8b4763fb180e800279585",
"versionType": "git"
},
{
"status": "affected",
"version": "2d046892a493d9760c35fdaefc3017f27f91b621",
"versionType": "git"
},
{
"lessThan": "6.1",
"status": "affected",
"version": "6.0.16",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2file.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.0.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: fix possible infinite loop and oob read in symlink_data()\n\nOn 32-bit architectures, the infinite loop is as follows:\n\n len = p-\u003eErrorDataLength == 0xfffffff8\n u8 *next = p-\u003eErrorContextData + len\n next == p\n\nOn 32-bit architectures, the out-of-bounds read is as follows:\n\n len = p-\u003eErrorDataLength == 0xfffffff0\n u8 *next = p-\u003eErrorContextData + len\n next == (u8 *)p - 8"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable SMB client parser consumes an SMB2 CREATE error response supplied by a remote SMB server over the network. A malicious or compromised SMB share can send the crafted `STATUS_STOPPED_ON_SYMLINK` response.\nAC:L - The server directly controls `ErrorContextCount`, `ByteCount`, `ErrorId`, and `ErrorDataLength`, and no race or hard-to-hit state is required. Although the wraparound behavior is 32-bit specific, that is a deployment property rather than an attacker-uncontrolled exploitation condition.\nPR:N - The attacker needs no privileges on the victim system; they only need to operate or control the SMB server endpoint that the client connects to. The path can also be reached through guest or null-auth SMB sessions.\nUI:R - The victim client must mount/connect to the SMB share and perform a path operation such as lookup, stat, open, or create that causes an SMB2 CREATE response to be parsed. The remote server cannot trigger this parser without client-side filesystem activity.\nS:U - The affected component is the Linux kernel SMB client, and the impact is to the same kernel/client security authority. This is not a VM escape, IOMMU bypass, or cross-scope sandbox escape.\nC:H - The bug is an out-of-bounds kernel read in a server-controlled response parser, and the read is not strictly bounded to only a few harmless bytes. Following the required conservative rule, this is scored as high confidentiality impact.\nI:N - The defect advances a parser pointer incorrectly and reads from the wrong location, but it does not write out of bounds or provide a kernel memory write primitive. No direct integrity impact beyond normal malicious-server control of SMB content was identified.\nA:H - The crafted length can make the parser loop indefinitely on 32-bit systems, causing a reliable denial of service. Other malformed pointer positions can also lead to invalid kernel reads and possible oops conditions."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:11.748Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1cfa2d59f669db28d6292d10ff87ca6837c781b0"
},
{
"url": "https://git.kernel.org/stable/c/b41598bf54b3fe528994e573df6008f8f4d0a4f4"
},
{
"url": "https://git.kernel.org/stable/c/cd4b9b662f0fb9aa97ee6bf9034eca76fc6cab23"
},
{
"url": "https://git.kernel.org/stable/c/97a05b0ae9ea5ec052be2eef0f9cc7ce03501bbb"
},
{
"url": "https://git.kernel.org/stable/c/1b9331b16b0ed9414dcf7583d8134bdfeb117aae"
},
{
"url": "https://git.kernel.org/stable/c/7d9a7f1f96cd617ee9e75bb22217c709038e26b8"
}
],
"title": "smb/client: fix possible infinite loop and oob read in symlink_data()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52967",
"datePublished": "2026-06-24T16:28:46.661Z",
"dateReserved": "2026-06-09T07:44:35.374Z",
"dateUpdated": "2026-08-05T12:32:11.748Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52985 (GCVE-0-2026-52985)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-06-24 16:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netdevsim: zero initialize struct iphdr in dummy sk_buff
Syzbot reports a KMSAN uninit-value originating from
nsim_dev_trap_skb_build, with the allocation also
being performed in the same function.
Fix this by calling skb_put_zero instead of skb_put to
guarantee zero initialization of the whole IP header.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: da58f90f11f597520f226caff1d3cfc115abedc9 Version: da58f90f11f597520f226caff1d3cfc115abedc9 Version: da58f90f11f597520f226caff1d3cfc115abedc9 Version: da58f90f11f597520f226caff1d3cfc115abedc9 Version: da58f90f11f597520f226caff1d3cfc115abedc9 Version: da58f90f11f597520f226caff1d3cfc115abedc9 Version: da58f90f11f597520f226caff1d3cfc115abedc9 Version: da58f90f11f597520f226caff1d3cfc115abedc9 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/netdevsim/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "175556c049eaec14efde8c6475e763b7579b9de7",
"status": "affected",
"version": "da58f90f11f597520f226caff1d3cfc115abedc9",
"versionType": "git"
},
{
"lessThan": "6e2cfd0904976e701d7a76b86b694e72af230ab0",
"status": "affected",
"version": "da58f90f11f597520f226caff1d3cfc115abedc9",
"versionType": "git"
},
{
"lessThan": "1b7b6ae0e93b8d512e208b1378d74af052e4f4e7",
"status": "affected",
"version": "da58f90f11f597520f226caff1d3cfc115abedc9",
"versionType": "git"
},
{
"lessThan": "818f7673ed7f4a29d4b9cee8184c47d6e57162b4",
"status": "affected",
"version": "da58f90f11f597520f226caff1d3cfc115abedc9",
"versionType": "git"
},
{
"lessThan": "978ca6ff789f1f19c03288ac20cc1f4774e88490",
"status": "affected",
"version": "da58f90f11f597520f226caff1d3cfc115abedc9",
"versionType": "git"
},
{
"lessThan": "750d0091bebf44975421268d37484ef87060d263",
"status": "affected",
"version": "da58f90f11f597520f226caff1d3cfc115abedc9",
"versionType": "git"
},
{
"lessThan": "bc6002865e8c4fcf9e94975f7cf023448d8764e2",
"status": "affected",
"version": "da58f90f11f597520f226caff1d3cfc115abedc9",
"versionType": "git"
},
{
"lessThan": "35eaa6d8d6c2ee65e96f507add856e0eacf24591",
"status": "affected",
"version": "da58f90f11f597520f226caff1d3cfc115abedc9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/netdevsim/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetdevsim: zero initialize struct iphdr in dummy sk_buff\n\nSyzbot reports a KMSAN uninit-value originating from\nnsim_dev_trap_skb_build, with the allocation also\nbeing performed in the same function.\n\nFix this by calling skb_put_zero instead of skb_put to\nguarantee zero initialization of the whole IP header."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:28:59.871Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/175556c049eaec14efde8c6475e763b7579b9de7"
},
{
"url": "https://git.kernel.org/stable/c/6e2cfd0904976e701d7a76b86b694e72af230ab0"
},
{
"url": "https://git.kernel.org/stable/c/1b7b6ae0e93b8d512e208b1378d74af052e4f4e7"
},
{
"url": "https://git.kernel.org/stable/c/818f7673ed7f4a29d4b9cee8184c47d6e57162b4"
},
{
"url": "https://git.kernel.org/stable/c/978ca6ff789f1f19c03288ac20cc1f4774e88490"
},
{
"url": "https://git.kernel.org/stable/c/750d0091bebf44975421268d37484ef87060d263"
},
{
"url": "https://git.kernel.org/stable/c/bc6002865e8c4fcf9e94975f7cf023448d8764e2"
},
{
"url": "https://git.kernel.org/stable/c/35eaa6d8d6c2ee65e96f507add856e0eacf24591"
}
],
"title": "netdevsim: zero initialize struct iphdr in dummy sk_buff",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52985",
"datePublished": "2026-06-24T16:28:59.871Z",
"dateReserved": "2026-06-09T07:44:35.376Z",
"dateUpdated": "2026-06-24T16:28:59.871Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53064 (GCVE-0-2026-53064)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-06-24 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm cache: fix null-deref with concurrent writes in passthrough mode
In passthrough mode, when dm-cache starts to invalidate a cache
entry and bio prison cell lock fails due to concurrent write to
the same cached block, mg->cell remains NULL. The error path in
invalidate_complete() attempts to unlock and free the cell
unconditionally, causing a NULL pointer dereference:
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 UID: 0 PID: 134 Comm: fio Not tainted 6.19.0-rc7 #3 PREEMPT
RIP: 0010:dm_cell_unlock_v2+0x3f/0x210
<snip>
Call Trace:
invalidate_complete+0xef/0x430
map_bio+0x130f/0x1a10
cache_map+0x320/0x6b0
__map_bio+0x458/0x510
dm_submit_bio+0x40e/0x16d0
__submit_bio+0x419/0x870
<snip>
Reproduce steps:
1. Create a cache device
dmsetup create cmeta --table "0 8192 linear /dev/sdc 0"
dmsetup create cdata --table "0 131072 linear /dev/sdc 8192"
dmsetup create corig --table "0 262144 linear /dev/sdc 262144"
dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct
dmsetup create cache --table "0 262144 cache /dev/mapper/cmeta \
/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0"
2. Promote the first data block into cache
fio --filename=/dev/mapper/cache --name=populate --rw=write --bs=4k \
--direct=1 --size=64k
3. Reload the cache into passthrough mode
dmsetup suspend cache
dmsetup reload cache --table "0 262144 cache /dev/mapper/cmeta \
/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0"
dmsetup resume cache
4. Write to the first cached block concurrently
fio --filename=/dev/mapper/cache --name test --rw=randwrite --bs=4k \
--randrepeat=0 --direct=1 --numjobs=2 --size 64k
Fix by checking if mg->cell is valid before attempting to unlock it.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b29d4986d0da1a27cd35917cdb433672f5c95d7f Version: b29d4986d0da1a27cd35917cdb433672f5c95d7f Version: b29d4986d0da1a27cd35917cdb433672f5c95d7f Version: b29d4986d0da1a27cd35917cdb433672f5c95d7f Version: b29d4986d0da1a27cd35917cdb433672f5c95d7f Version: b29d4986d0da1a27cd35917cdb433672f5c95d7f Version: b29d4986d0da1a27cd35917cdb433672f5c95d7f Version: b29d4986d0da1a27cd35917cdb433672f5c95d7f |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-cache-target.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "01264a6a3a3ad7ac1d73443299cd5a9568002454",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "ee38fb00e1a80f46a4990e38f25ecb04ae7b7417",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "c7fb6bc864c4910b344dafa36dd5028e9b980768",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "0aa745fea1f8dc81bcdd0a45e215b6706727b482",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "a2635d541a93fd111e743cf14b6275dc81be2abc",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "25dcc1989c194ba2b5fb6d03cbb9b83814ac0d15",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "df3b8ef06cc62de4fca5d2108e285085b3cffd44",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
},
{
"lessThan": "7d1f98d668ee34c1d15bdc0420fdd062f24a27c0",
"status": "affected",
"version": "b29d4986d0da1a27cd35917cdb433672f5c95d7f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-cache-target.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm cache: fix null-deref with concurrent writes in passthrough mode\n\nIn passthrough mode, when dm-cache starts to invalidate a cache\nentry and bio prison cell lock fails due to concurrent write to\nthe same cached block, mg-\u003ecell remains NULL. The error path in\ninvalidate_complete() attempts to unlock and free the cell\nunconditionally, causing a NULL pointer dereference:\n\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 0 UID: 0 PID: 134 Comm: fio Not tainted 6.19.0-rc7 #3 PREEMPT\nRIP: 0010:dm_cell_unlock_v2+0x3f/0x210\n\u003csnip\u003e\nCall Trace:\n invalidate_complete+0xef/0x430\n map_bio+0x130f/0x1a10\n cache_map+0x320/0x6b0\n __map_bio+0x458/0x510\n dm_submit_bio+0x40e/0x16d0\n __submit_bio+0x419/0x870\n\u003csnip\u003e\n\nReproduce steps:\n\n1. Create a cache device\n\ndmsetup create cmeta --table \"0 8192 linear /dev/sdc 0\"\ndmsetup create cdata --table \"0 131072 linear /dev/sdc 8192\"\ndmsetup create corig --table \"0 262144 linear /dev/sdc 262144\"\ndd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct\ndmsetup create cache --table \"0 262144 cache /dev/mapper/cmeta \\\n/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0\"\n\n2. Promote the first data block into cache\n\nfio --filename=/dev/mapper/cache --name=populate --rw=write --bs=4k \\\n--direct=1 --size=64k\n\n3. Reload the cache into passthrough mode\n\ndmsetup suspend cache\ndmsetup reload cache --table \"0 262144 cache /dev/mapper/cmeta \\\n/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0\"\ndmsetup resume cache\n\n4. Write to the first cached block concurrently\n\nfio --filename=/dev/mapper/cache --name test --rw=randwrite --bs=4k \\\n--randrepeat=0 --direct=1 --numjobs=2 --size 64k\n\nFix by checking if mg-\u003ecell is valid before attempting to unlock it."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:07.536Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/01264a6a3a3ad7ac1d73443299cd5a9568002454"
},
{
"url": "https://git.kernel.org/stable/c/ee38fb00e1a80f46a4990e38f25ecb04ae7b7417"
},
{
"url": "https://git.kernel.org/stable/c/c7fb6bc864c4910b344dafa36dd5028e9b980768"
},
{
"url": "https://git.kernel.org/stable/c/0aa745fea1f8dc81bcdd0a45e215b6706727b482"
},
{
"url": "https://git.kernel.org/stable/c/a2635d541a93fd111e743cf14b6275dc81be2abc"
},
{
"url": "https://git.kernel.org/stable/c/25dcc1989c194ba2b5fb6d03cbb9b83814ac0d15"
},
{
"url": "https://git.kernel.org/stable/c/df3b8ef06cc62de4fca5d2108e285085b3cffd44"
},
{
"url": "https://git.kernel.org/stable/c/7d1f98d668ee34c1d15bdc0420fdd062f24a27c0"
}
],
"title": "dm cache: fix null-deref with concurrent writes in passthrough mode",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53064",
"datePublished": "2026-06-24T16:30:07.536Z",
"dateReserved": "2026-06-09T07:44:35.382Z",
"dateUpdated": "2026-06-24T16:30:07.536Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52975 (GCVE-0-2026-52975)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bonding: 3ad: implement proper RCU rules for port->aggregator
syzbot found a data-race in bond_3ad_get_active_agg_info /
bond_3ad_state_machine_handler [1] which hints at lack of proper
RCU implementation.
Add __rcu qualifier to port->aggregator, and add proper RCU API.
[1]
BUG: KCSAN: data-race in bond_3ad_get_active_agg_info / bond_3ad_state_machine_handler
write to 0xffff88813cf5c4b0 of 8 bytes by task 36 on cpu 0:
ad_port_selection_logic drivers/net/bonding/bond_3ad.c:1659 [inline]
bond_3ad_state_machine_handler+0x9d5/0x2d60 drivers/net/bonding/bond_3ad.c:2569
process_one_work kernel/workqueue.c:3302 [inline]
process_scheduled_works+0x4f0/0x9c0 kernel/workqueue.c:3385
worker_thread+0x58a/0x780 kernel/workqueue.c:3466
kthread+0x22a/0x280 kernel/kthread.c:436
ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
read to 0xffff88813cf5c4b0 of 8 bytes by task 22063 on cpu 1:
__bond_3ad_get_active_agg_info drivers/net/bonding/bond_3ad.c:2858 [inline]
bond_3ad_get_active_agg_info+0x8c/0x230 drivers/net/bonding/bond_3ad.c:2881
bond_fill_info+0xe0f/0x10f0 drivers/net/bonding/bond_netlink.c:853
rtnl_link_info_fill net/core/rtnetlink.c:906 [inline]
rtnl_link_fill+0x1d7/0x4e0 net/core/rtnetlink.c:927
rtnl_fill_ifinfo+0xf8e/0x1380 net/core/rtnetlink.c:2168
rtmsg_ifinfo_build_skb+0x11c/0x1b0 net/core/rtnetlink.c:4453
rtmsg_ifinfo_event net/core/rtnetlink.c:4486 [inline]
rtmsg_ifinfo+0x6d/0x110 net/core/rtnetlink.c:4495
__dev_notify_flags+0x76/0x390 net/core/dev.c:9790
netif_change_flags+0xac/0xd0 net/core/dev.c:9823
do_setlink+0x905/0x2950 net/core/rtnetlink.c:3180
rtnl_group_changelink net/core/rtnetlink.c:3813 [inline]
__rtnl_newlink net/core/rtnetlink.c:3981 [inline]
rtnl_newlink+0xf55/0x1400 net/core/rtnetlink.c:4109
rtnetlink_rcv_msg+0x64b/0x720 net/core/rtnetlink.c:6995
netlink_rcv_skb+0x123/0x220 net/netlink/af_netlink.c:2550
rtnetlink_rcv+0x1c/0x30 net/core/rtnetlink.c:7022
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x5a8/0x680 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x5c8/0x6f0 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:787 [inline]
__sock_sendmsg net/socket.c:802 [inline]
____sys_sendmsg+0x563/0x5b0 net/socket.c:2698
___sys_sendmsg+0x195/0x1e0 net/socket.c:2752
__sys_sendmsg net/socket.c:2784 [inline]
__do_sys_sendmsg net/socket.c:2789 [inline]
__se_sys_sendmsg net/socket.c:2787 [inline]
__x64_sys_sendmsg+0xd4/0x160 net/socket.c:2787
x64_sys_call+0x194c/0x3020 arch/x86/include/generated/asm/syscalls_64.h:47
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x12c/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
value changed: 0x0000000000000000 -> 0xffff88813cf5c400
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 22063 Comm: syz.0.31122 Tainted: G W syzkaller #0 PREEMPT(full)
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 47e91f56008b43e1365e8d1d4a6813fe8a33b6f6 Version: 47e91f56008b43e1365e8d1d4a6813fe8a33b6f6 Version: 47e91f56008b43e1365e8d1d4a6813fe8a33b6f6 Version: 47e91f56008b43e1365e8d1d4a6813fe8a33b6f6 Version: 47e91f56008b43e1365e8d1d4a6813fe8a33b6f6 Version: 47e91f56008b43e1365e8d1d4a6813fe8a33b6f6 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/bonding/bond_3ad.c",
"drivers/net/bonding/bond_main.c",
"drivers/net/bonding/bond_netlink.c",
"drivers/net/bonding/bond_procfs.c",
"drivers/net/bonding/bond_sysfs_slave.c",
"include/net/bond_3ad.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ba2272be04f0cb1e74e1e355ff32ef95df280731",
"status": "affected",
"version": "47e91f56008b43e1365e8d1d4a6813fe8a33b6f6",
"versionType": "git"
},
{
"lessThan": "3b7265b3a82f40d2357c4004b26eb794a095b186",
"status": "affected",
"version": "47e91f56008b43e1365e8d1d4a6813fe8a33b6f6",
"versionType": "git"
},
{
"lessThan": "5fb9ea4e8ebf514d92df2b6c9d0db25ba02ac735",
"status": "affected",
"version": "47e91f56008b43e1365e8d1d4a6813fe8a33b6f6",
"versionType": "git"
},
{
"lessThan": "c169c5837525ad842df6a542facf52b6f866a519",
"status": "affected",
"version": "47e91f56008b43e1365e8d1d4a6813fe8a33b6f6",
"versionType": "git"
},
{
"lessThan": "78f409fd34fe9de2b24ad8e9dca1b4608a48ed3d",
"status": "affected",
"version": "47e91f56008b43e1365e8d1d4a6813fe8a33b6f6",
"versionType": "git"
},
{
"lessThan": "c4f050ce06c56cfb5993268af4a5cb66ed1cd04e",
"status": "affected",
"version": "47e91f56008b43e1365e8d1d4a6813fe8a33b6f6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/bonding/bond_3ad.c",
"drivers/net/bonding/bond_main.c",
"drivers/net/bonding/bond_netlink.c",
"drivers/net/bonding/bond_procfs.c",
"drivers/net/bonding/bond_sysfs_slave.c",
"include/net/bond_3ad.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.13"
},
{
"lessThan": "3.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: 3ad: implement proper RCU rules for port-\u003eaggregator\n\nsyzbot found a data-race in bond_3ad_get_active_agg_info /\nbond_3ad_state_machine_handler [1] which hints at lack of proper\nRCU implementation.\n\nAdd __rcu qualifier to port-\u003eaggregator, and add proper RCU API.\n\n[1]\n\nBUG: KCSAN: data-race in bond_3ad_get_active_agg_info / bond_3ad_state_machine_handler\n\nwrite to 0xffff88813cf5c4b0 of 8 bytes by task 36 on cpu 0:\n ad_port_selection_logic drivers/net/bonding/bond_3ad.c:1659 [inline]\n bond_3ad_state_machine_handler+0x9d5/0x2d60 drivers/net/bonding/bond_3ad.c:2569\n process_one_work kernel/workqueue.c:3302 [inline]\n process_scheduled_works+0x4f0/0x9c0 kernel/workqueue.c:3385\n worker_thread+0x58a/0x780 kernel/workqueue.c:3466\n kthread+0x22a/0x280 kernel/kthread.c:436\n ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n\nread to 0xffff88813cf5c4b0 of 8 bytes by task 22063 on cpu 1:\n __bond_3ad_get_active_agg_info drivers/net/bonding/bond_3ad.c:2858 [inline]\n bond_3ad_get_active_agg_info+0x8c/0x230 drivers/net/bonding/bond_3ad.c:2881\n bond_fill_info+0xe0f/0x10f0 drivers/net/bonding/bond_netlink.c:853\n rtnl_link_info_fill net/core/rtnetlink.c:906 [inline]\n rtnl_link_fill+0x1d7/0x4e0 net/core/rtnetlink.c:927\n rtnl_fill_ifinfo+0xf8e/0x1380 net/core/rtnetlink.c:2168\n rtmsg_ifinfo_build_skb+0x11c/0x1b0 net/core/rtnetlink.c:4453\n rtmsg_ifinfo_event net/core/rtnetlink.c:4486 [inline]\n rtmsg_ifinfo+0x6d/0x110 net/core/rtnetlink.c:4495\n __dev_notify_flags+0x76/0x390 net/core/dev.c:9790\n netif_change_flags+0xac/0xd0 net/core/dev.c:9823\n do_setlink+0x905/0x2950 net/core/rtnetlink.c:3180\n rtnl_group_changelink net/core/rtnetlink.c:3813 [inline]\n __rtnl_newlink net/core/rtnetlink.c:3981 [inline]\n rtnl_newlink+0xf55/0x1400 net/core/rtnetlink.c:4109\n rtnetlink_rcv_msg+0x64b/0x720 net/core/rtnetlink.c:6995\n netlink_rcv_skb+0x123/0x220 net/netlink/af_netlink.c:2550\n rtnetlink_rcv+0x1c/0x30 net/core/rtnetlink.c:7022\n netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]\n netlink_unicast+0x5a8/0x680 net/netlink/af_netlink.c:1344\n netlink_sendmsg+0x5c8/0x6f0 net/netlink/af_netlink.c:1894\n sock_sendmsg_nosec net/socket.c:787 [inline]\n __sock_sendmsg net/socket.c:802 [inline]\n ____sys_sendmsg+0x563/0x5b0 net/socket.c:2698\n ___sys_sendmsg+0x195/0x1e0 net/socket.c:2752\n __sys_sendmsg net/socket.c:2784 [inline]\n __do_sys_sendmsg net/socket.c:2789 [inline]\n __se_sys_sendmsg net/socket.c:2787 [inline]\n __x64_sys_sendmsg+0xd4/0x160 net/socket.c:2787\n x64_sys_call+0x194c/0x3020 arch/x86/include/generated/asm/syscalls_64.h:47\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x12c/0x3b0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nvalue changed: 0x0000000000000000 -\u003e 0xffff88813cf5c400\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 1 UID: 0 PID: 22063 Comm: syz.0.31122 Tainted: G W syzkaller #0 PREEMPT(full)\nTainted: [W]=WARN\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable paths are local bonding control/information paths such as rtnetlink, sysfs, and procfs racing with the 802.3ad workqueue. A remote packet alone is not sufficient for the complete race; a local attacker can exercise the reader and drive bond state changes.\nAC:L - A local attacker can create/configure an 802.3ad bond in a user/network namespace and repeatedly issue concurrent link queries while the bond workqueue updates port-\u003eaggregator. The race is attacker-influenced and does not depend on rare conditions outside the attacker\u0027s control.\nPR:L - Bond creation and many control operations require CAP_NET_ADMIN, but that is reachable by an unprivileged user inside a user namespace. RTM_GETLINK-style readers are even less restricted, but exploitation still assumes a local unprivileged user context.\nUI:N - No victim action is required once the attacker can run local commands or netlink requests. The attacker can trigger the relevant reader and writer activity directly.\nS:U - The impact remains within the kernel and the host networking subsystem security authority. This is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The bug is an RCU lifetime violation on port-\u003eaggregator, which points into per-slave ad_slave_info memory that can be cleared, freed, or reused. Treating the stale-pointer/UAF condition conservatively, it can expose kernel memory through groomed object reuse.\nI:H - A stale kernel pointer/UAF in attacker-controllable bonding state is a memory-safety issue that can plausibly be heap-groomed beyond a simple crash. Under the required overestimation rule, this supports high integrity impact.\nA:H - At minimum, racing dereferences of port-\u003eaggregator can lead to invalid pointer dereferences, inconsistent list traversal, oops, or panic. The vulnerability is therefore capable of causing a kernel-level denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:17.100Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ba2272be04f0cb1e74e1e355ff32ef95df280731"
},
{
"url": "https://git.kernel.org/stable/c/3b7265b3a82f40d2357c4004b26eb794a095b186"
},
{
"url": "https://git.kernel.org/stable/c/5fb9ea4e8ebf514d92df2b6c9d0db25ba02ac735"
},
{
"url": "https://git.kernel.org/stable/c/c169c5837525ad842df6a542facf52b6f866a519"
},
{
"url": "https://git.kernel.org/stable/c/78f409fd34fe9de2b24ad8e9dca1b4608a48ed3d"
},
{
"url": "https://git.kernel.org/stable/c/c4f050ce06c56cfb5993268af4a5cb66ed1cd04e"
}
],
"title": "bonding: 3ad: implement proper RCU rules for port-\u003eaggregator",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52975",
"datePublished": "2026-06-24T16:28:52.514Z",
"dateReserved": "2026-06-09T07:44:35.376Z",
"dateUpdated": "2026-08-05T12:32:17.100Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53066 (GCVE-0-2026-53066)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-06-24 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/sun4i: backend: fix error pointer dereference
The function drm_atomic_get_plane_state() can return an error pointer
and is not checked for it. Add error pointer check.
Detected by Smatch:
drivers/gpu/drm/sun4i/sun4i_backend.c:496 sun4i_backend_atomic_check() error:
'plane_state' dereferencing possible ERR_PTR()
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 96180dde23b799272ab2e7d47210c8840799d0d2 Version: 96180dde23b799272ab2e7d47210c8840799d0d2 Version: 96180dde23b799272ab2e7d47210c8840799d0d2 Version: 96180dde23b799272ab2e7d47210c8840799d0d2 Version: 96180dde23b799272ab2e7d47210c8840799d0d2 Version: 96180dde23b799272ab2e7d47210c8840799d0d2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/sun4i/sun4i_backend.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ea51fd96aca01381e8f1ac0c671a57b7619193bb",
"status": "affected",
"version": "96180dde23b799272ab2e7d47210c8840799d0d2",
"versionType": "git"
},
{
"lessThan": "cf615b90a11a39a28e313be5e508e94bcde72016",
"status": "affected",
"version": "96180dde23b799272ab2e7d47210c8840799d0d2",
"versionType": "git"
},
{
"lessThan": "779c2f10743fc021f2f0ebe2b188cadfb973c5e4",
"status": "affected",
"version": "96180dde23b799272ab2e7d47210c8840799d0d2",
"versionType": "git"
},
{
"lessThan": "47038159c559824f4dbfb5b0d87b9b3416663372",
"status": "affected",
"version": "96180dde23b799272ab2e7d47210c8840799d0d2",
"versionType": "git"
},
{
"lessThan": "e9bef62f1bb9fcb38223730657af20f4c6283c16",
"status": "affected",
"version": "96180dde23b799272ab2e7d47210c8840799d0d2",
"versionType": "git"
},
{
"lessThan": "06277983eca4a31d3c2114fa33d99a6e82484b11",
"status": "affected",
"version": "96180dde23b799272ab2e7d47210c8840799d0d2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/sun4i/sun4i_backend.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sun4i: backend: fix error pointer dereference\n\nThe function drm_atomic_get_plane_state() can return an error pointer\nand is not checked for it. Add error pointer check.\n\nDetected by Smatch:\ndrivers/gpu/drm/sun4i/sun4i_backend.c:496 sun4i_backend_atomic_check() error:\n\u0027plane_state\u0027 dereferencing possible ERR_PTR()"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:08.824Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ea51fd96aca01381e8f1ac0c671a57b7619193bb"
},
{
"url": "https://git.kernel.org/stable/c/cf615b90a11a39a28e313be5e508e94bcde72016"
},
{
"url": "https://git.kernel.org/stable/c/779c2f10743fc021f2f0ebe2b188cadfb973c5e4"
},
{
"url": "https://git.kernel.org/stable/c/47038159c559824f4dbfb5b0d87b9b3416663372"
},
{
"url": "https://git.kernel.org/stable/c/e9bef62f1bb9fcb38223730657af20f4c6283c16"
},
{
"url": "https://git.kernel.org/stable/c/06277983eca4a31d3c2114fa33d99a6e82484b11"
}
],
"title": "drm/sun4i: backend: fix error pointer dereference",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53066",
"datePublished": "2026-06-24T16:30:08.824Z",
"dateReserved": "2026-06-09T07:44:35.382Z",
"dateUpdated": "2026-06-24T16:30:08.824Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53002 (GCVE-0-2026-53002)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack: remove sprintf usage
Replace it with scnprintf, the buffer sizes are expected to be large enough
to hold the result, no need for snprintf+overflow check.
Increase buffer size in mangle_content_len() while at it.
BUG: KASAN: stack-out-of-bounds in vsnprintf+0xea5/0x1270
Write of size 1 at addr [..]
vsnprintf+0xea5/0x1270
sprintf+0xb1/0xe0
mangle_content_len+0x1ac/0x280
nf_nat_sdp_session+0x1cc/0x240
process_sdp+0x8f8/0xb80
process_invite_request+0x108/0x2b0
process_sip_msg+0x5da/0xf50
sip_help_tcp+0x45e/0x780
nf_confirm+0x34d/0x990
[..]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9fafcd7b203229c3f3893a475741afc27e276306 Version: 9fafcd7b203229c3f3893a475741afc27e276306 Version: 9fafcd7b203229c3f3893a475741afc27e276306 Version: 9fafcd7b203229c3f3893a475741afc27e276306 Version: 9fafcd7b203229c3f3893a475741afc27e276306 Version: 9fafcd7b203229c3f3893a475741afc27e276306 Version: 9fafcd7b203229c3f3893a475741afc27e276306 Version: 9fafcd7b203229c3f3893a475741afc27e276306 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s netfilter conntrack module. This vulnerability arises from the use of `sprintf` and insufficient buffer sizing in the `mangle_content_len()` function, which can lead to a stack-out-of-bounds write. An attacker could potentially exploit this memory corruption issue to cause a denial of service or other unspecified impacts."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:14:50.281Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-53002"
},
{
"name": "RHBZ#2492329",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492329"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53002.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: netfilter: conntrack: remove sprintf usage",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this issue, prevent the nf_conntrack_sip and nf_nat_sip modules from being loaded. See https://access.redhat.com/solutions/41278 for instructions."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_nat_amanda.c",
"net/netfilter/nf_nat_sip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2f793ba78470a99f40389b7dc60a81d9f5ad3956",
"status": "affected",
"version": "9fafcd7b203229c3f3893a475741afc27e276306",
"versionType": "git"
},
{
"lessThan": "6bbf829b4c1b44c941c47dd0d710f1393258f3d5",
"status": "affected",
"version": "9fafcd7b203229c3f3893a475741afc27e276306",
"versionType": "git"
},
{
"lessThan": "ab64e61c9323fa6de21bd20da1ddb29a0fb65d34",
"status": "affected",
"version": "9fafcd7b203229c3f3893a475741afc27e276306",
"versionType": "git"
},
{
"lessThan": "1c9fb8aeed06790d42cdcd00f6c3ce0b9e926c1e",
"status": "affected",
"version": "9fafcd7b203229c3f3893a475741afc27e276306",
"versionType": "git"
},
{
"lessThan": "a8e0a32a23d3f34862af3b4da792ecb3a891a9a3",
"status": "affected",
"version": "9fafcd7b203229c3f3893a475741afc27e276306",
"versionType": "git"
},
{
"lessThan": "8e3be0d12615a173fe260cd42753ca7a001acbf2",
"status": "affected",
"version": "9fafcd7b203229c3f3893a475741afc27e276306",
"versionType": "git"
},
{
"lessThan": "c08ff52e44945e6ef4ce0790f49ea761b060c45b",
"status": "affected",
"version": "9fafcd7b203229c3f3893a475741afc27e276306",
"versionType": "git"
},
{
"lessThan": "6e7066bdb481a87fe88c4fa563e348c03b2d373d",
"status": "affected",
"version": "9fafcd7b203229c3f3893a475741afc27e276306",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_nat_amanda.c",
"net/netfilter/nf_nat_sip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.20"
},
{
"lessThan": "2.6.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack: remove sprintf usage\n\nReplace it with scnprintf, the buffer sizes are expected to be large enough\nto hold the result, no need for snprintf+overflow check.\n\nIncrease buffer size in mangle_content_len() while at it.\n\nBUG: KASAN: stack-out-of-bounds in vsnprintf+0xea5/0x1270\nWrite of size 1 at addr [..]\n vsnprintf+0xea5/0x1270\n sprintf+0xb1/0xe0\n mangle_content_len+0x1ac/0x280\n nf_nat_sdp_session+0x1cc/0x240\n process_sdp+0x8f8/0xb80\n process_invite_request+0x108/0x2b0\n process_sip_msg+0x5da/0xf50\n sip_help_tcp+0x45e/0x780\n nf_confirm+0x34d/0x990\n [..]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable SIP NAT helper is reached from network packet processing when a target acts as a SIP-aware NAT/conntrack gateway. A remote peer can send crafted SIP/SDP traffic through that configured path.\nAC:L - No race or hard-to-control state is required; the attacker controls the SIP/SDP payload and can drive the oversized Content-Length recomputation. The needed NAT/helper configuration is a normal deployment condition for SIP ALG/firewall use.\nPR:N - In the remote deployment scenario, the attacker only sends network traffic and does not need local credentials or administrative privileges on the target. Local helper setup would require CAP_NET_ADMIN, but that is not required when attacking an already configured SIP NAT gateway.\nUI:N - No victim user action is required once the vulnerable helper is active. Packet processing happens automatically in the netfilter conntrack/NAT path.\nS:U - The corruption occurs inside the Linux kernel networking stack and impacts the same kernel security authority. There is no VM, IOMMU, or cross-authority boundary change.\nC:H - This is kernel stack memory corruption from an out-of-bounds sprintf write. Even though the report shows a KASAN crash, such memory corruption can plausibly be leveraged toward broader kernel compromise, so the higher severity value is appropriate.\nI:H - The bug is an out-of-bounds write on the kernel stack in packet processing. Kernel memory corruption can plausibly alter control data or enable code execution, so integrity impact is high.\nA:H - The reported failure is a KASAN stack-out-of-bounds write in kernel context and can crash or panic the system. The crafted traffic can be sent repeatedly to sustain denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:32.201Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2f793ba78470a99f40389b7dc60a81d9f5ad3956"
},
{
"url": "https://git.kernel.org/stable/c/6bbf829b4c1b44c941c47dd0d710f1393258f3d5"
},
{
"url": "https://git.kernel.org/stable/c/ab64e61c9323fa6de21bd20da1ddb29a0fb65d34"
},
{
"url": "https://git.kernel.org/stable/c/1c9fb8aeed06790d42cdcd00f6c3ce0b9e926c1e"
},
{
"url": "https://git.kernel.org/stable/c/a8e0a32a23d3f34862af3b4da792ecb3a891a9a3"
},
{
"url": "https://git.kernel.org/stable/c/8e3be0d12615a173fe260cd42753ca7a001acbf2"
},
{
"url": "https://git.kernel.org/stable/c/c08ff52e44945e6ef4ce0790f49ea761b060c45b"
},
{
"url": "https://git.kernel.org/stable/c/6e7066bdb481a87fe88c4fa563e348c03b2d373d"
}
],
"title": "netfilter: conntrack: remove sprintf usage",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53002",
"datePublished": "2026-06-24T16:29:14.391Z",
"dateReserved": "2026-06-09T07:44:35.377Z",
"dateUpdated": "2026-08-05T12:32:32.201Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53074 (GCVE-0-2026-53074)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-06-24 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb
bpf_prog_test_run_skb() calls eth_type_trans() first and then uses
skb->protocol to initialize sk family and address fields for the test
run.
For IPv4 and IPv6 packets, it may access ip_hdr(skb) or ipv6_hdr(skb)
even when the provided test input only contains an Ethernet header.
Reject the input earlier if the Ethernet frame carries IPv4/IPv6
EtherType but the L3 header is too short.
Fold the IPv4/IPv6 header length checks into the existing protocol
switch and return -EINVAL before accessing the network headers.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: fa5cb548ced61b9d3095f32f8a7e427a248c65ee Version: fa5cb548ced61b9d3095f32f8a7e427a248c65ee Version: fa5cb548ced61b9d3095f32f8a7e427a248c65ee Version: fa5cb548ced61b9d3095f32f8a7e427a248c65ee Version: fa5cb548ced61b9d3095f32f8a7e427a248c65ee Version: fa5cb548ced61b9d3095f32f8a7e427a248c65ee Version: fa5cb548ced61b9d3095f32f8a7e427a248c65ee Version: fa5cb548ced61b9d3095f32f8a7e427a248c65ee |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bpf/test_run.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7254267799d083280c0e53effc101a33add95f7b",
"status": "affected",
"version": "fa5cb548ced61b9d3095f32f8a7e427a248c65ee",
"versionType": "git"
},
{
"lessThan": "6a9f38d5ff11e00bc54baab752642978805e81eb",
"status": "affected",
"version": "fa5cb548ced61b9d3095f32f8a7e427a248c65ee",
"versionType": "git"
},
{
"lessThan": "e6aa481f21fc7a41ed344767ea25aae9d03fae71",
"status": "affected",
"version": "fa5cb548ced61b9d3095f32f8a7e427a248c65ee",
"versionType": "git"
},
{
"lessThan": "0a04db240effd85773f66244645a28cedddb72d2",
"status": "affected",
"version": "fa5cb548ced61b9d3095f32f8a7e427a248c65ee",
"versionType": "git"
},
{
"lessThan": "1f882c492d46f90bdb36f4936876c88c28dab21c",
"status": "affected",
"version": "fa5cb548ced61b9d3095f32f8a7e427a248c65ee",
"versionType": "git"
},
{
"lessThan": "8042240412de3222d27b31e89d29336961cad9e4",
"status": "affected",
"version": "fa5cb548ced61b9d3095f32f8a7e427a248c65ee",
"versionType": "git"
},
{
"lessThan": "6def5fe753cbe5b279ee5fd10327b2611cbddaca",
"status": "affected",
"version": "fa5cb548ced61b9d3095f32f8a7e427a248c65ee",
"versionType": "git"
},
{
"lessThan": "12bec2bd4b76d81c5d3996bd14ec1b7f4d983747",
"status": "affected",
"version": "fa5cb548ced61b9d3095f32f8a7e427a248c65ee",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bpf/test_run.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"lessThan": "5.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb\n\nbpf_prog_test_run_skb() calls eth_type_trans() first and then uses\nskb-\u003eprotocol to initialize sk family and address fields for the test\nrun.\n\nFor IPv4 and IPv6 packets, it may access ip_hdr(skb) or ipv6_hdr(skb)\neven when the provided test input only contains an Ethernet header.\n\nReject the input earlier if the Ethernet frame carries IPv4/IPv6\nEtherType but the L3 header is too short.\n\nFold the IPv4/IPv6 header length checks into the existing protocol\nswitch and return -EINVAL before accessing the network headers."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:15.337Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7254267799d083280c0e53effc101a33add95f7b"
},
{
"url": "https://git.kernel.org/stable/c/6a9f38d5ff11e00bc54baab752642978805e81eb"
},
{
"url": "https://git.kernel.org/stable/c/e6aa481f21fc7a41ed344767ea25aae9d03fae71"
},
{
"url": "https://git.kernel.org/stable/c/0a04db240effd85773f66244645a28cedddb72d2"
},
{
"url": "https://git.kernel.org/stable/c/1f882c492d46f90bdb36f4936876c88c28dab21c"
},
{
"url": "https://git.kernel.org/stable/c/8042240412de3222d27b31e89d29336961cad9e4"
},
{
"url": "https://git.kernel.org/stable/c/6def5fe753cbe5b279ee5fd10327b2611cbddaca"
},
{
"url": "https://git.kernel.org/stable/c/12bec2bd4b76d81c5d3996bd14ec1b7f4d983747"
}
],
"title": "bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53074",
"datePublished": "2026-06-24T16:30:15.337Z",
"dateReserved": "2026-06-09T07:44:35.383Z",
"dateUpdated": "2026-06-24T16:30:15.337Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53058 (GCVE-0-2026-53058)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-06-24 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable()
In case if we get errors in cdns_mhdp_link_up() or cdns_mhdp_reg_read()
in atomic_enable, we will go to cdns_mhdp_modeset_retry_fn() and will hit
NULL pointer while trying to access the mutex. We need the connector to
be set before that. Unlike in legacy cases with flag
!DRM_BRIDGE_ATTACH_NO_CONNECTOR, we do not have connector initialised
in bridge_attach(), so add the mhdp->connector_ptr in device structure
to handle both cases with DRM_BRIDGE_ATTACH_NO_CONNECTOR and
!DRM_BRIDGE_ATTACH_NO_CONNECTOR, set it in atomic_enable() earlier to
avoid possible NULL pointer dereference in recovery paths like
modeset_retry_fn() with the DRM_BRIDGE_ATTACH_NO_CONNECTOR flag set.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c",
"drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.h",
"drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5302015daf26ef6b48e067f2b86c9482ac19e015",
"status": "affected",
"version": "c932ced6b58524eeb948ff252f6512cd6bcb9d9f",
"versionType": "git"
},
{
"lessThan": "a3611554e599d1a24b45fd8415bacb72ce861e4b",
"status": "affected",
"version": "c932ced6b58524eeb948ff252f6512cd6bcb9d9f",
"versionType": "git"
},
{
"lessThan": "cf2ac2cac8b319f89b3a3851ca0c5ffb6a549575",
"status": "affected",
"version": "c932ced6b58524eeb948ff252f6512cd6bcb9d9f",
"versionType": "git"
},
{
"lessThan": "1af3b42e08a957e53bab8e1897393fe0a27d9fbf",
"status": "affected",
"version": "c932ced6b58524eeb948ff252f6512cd6bcb9d9f",
"versionType": "git"
},
{
"lessThan": "43d6508ddbf9fb974fbc359a033154f78c9d4c8b",
"status": "affected",
"version": "c932ced6b58524eeb948ff252f6512cd6bcb9d9f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c",
"drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.h",
"drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable()\n\nIn case if we get errors in cdns_mhdp_link_up() or cdns_mhdp_reg_read()\nin atomic_enable, we will go to cdns_mhdp_modeset_retry_fn() and will hit\nNULL pointer while trying to access the mutex. We need the connector to\nbe set before that. Unlike in legacy cases with flag\n!DRM_BRIDGE_ATTACH_NO_CONNECTOR, we do not have connector initialised\nin bridge_attach(), so add the mhdp-\u003econnector_ptr in device structure\nto handle both cases with DRM_BRIDGE_ATTACH_NO_CONNECTOR and\n!DRM_BRIDGE_ATTACH_NO_CONNECTOR, set it in atomic_enable() earlier to\navoid possible NULL pointer dereference in recovery paths like\nmodeset_retry_fn() with the DRM_BRIDGE_ATTACH_NO_CONNECTOR flag set."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:03.463Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5302015daf26ef6b48e067f2b86c9482ac19e015"
},
{
"url": "https://git.kernel.org/stable/c/a3611554e599d1a24b45fd8415bacb72ce861e4b"
},
{
"url": "https://git.kernel.org/stable/c/cf2ac2cac8b319f89b3a3851ca0c5ffb6a549575"
},
{
"url": "https://git.kernel.org/stable/c/1af3b42e08a957e53bab8e1897393fe0a27d9fbf"
},
{
"url": "https://git.kernel.org/stable/c/43d6508ddbf9fb974fbc359a033154f78c9d4c8b"
}
],
"title": "drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53058",
"datePublished": "2026-06-24T16:30:03.463Z",
"dateReserved": "2026-06-09T07:44:35.381Z",
"dateUpdated": "2026-06-24T16:30:03.463Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14164 (GCVE-0-2026-14164)
Vulnerability from cvelistv5
Published
2026-06-30 06:29
Modified
2026-08-25 09:40
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-415 - Double Free
Summary
A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.
References
| URL | Tags | ||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected: 0:3.7.7-10.el10_2 < * cpe:/o:redhat:enterprise_linux:10.2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14164",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-30T12:20:53.891666Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T12:22:17.042Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/libarchive/libarchive/issues/3069"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "libarchive",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.7.7-10.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "libarchive",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.7.7-5.el10_0.1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
],
"defaultStatus": "affected",
"packageName": "libarchive",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.5.3-11.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
],
"defaultStatus": "affected",
"packageName": "libarchive",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.5.3-11.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::appstream",
"cpe:/o:redhat:rhel_e4s:9.2::baseos"
],
"defaultStatus": "affected",
"packageName": "libarchive",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.5.3-5.el9_2.3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4::appstream",
"cpe:/o:redhat:rhel_e4s:9.4::baseos"
],
"defaultStatus": "affected",
"packageName": "libarchive",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.5.3-5.el9_4.2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6::appstream",
"cpe:/o:redhat:rhel_eus:9.6::baseos"
],
"defaultStatus": "affected",
"packageName": "libarchive",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.5.3-7.el9_6.2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.22.9.8.202608130832-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:discovery:2::el9"
],
"defaultStatus": "affected",
"packageName": "discovery/discovery-server-rhel9",
"product": "Red Hat Discovery 2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786638573",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "libarchive-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "3.8.8-2.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:rhui:5::el9"
],
"defaultStatus": "affected",
"packageName": "rhui5/cds-kubernetes-rhel9",
"product": "Red Hat Update Infrastructure 5",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786435241",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:rhui:5::el9"
],
"defaultStatus": "affected",
"packageName": "rhui5/cds-rhel9",
"product": "Red Hat Update Infrastructure 5",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786533457",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:rhui:5::el9"
],
"defaultStatus": "affected",
"packageName": "rhui5/haproxy-rhel9",
"product": "Red Hat Update Infrastructure 5",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786533449",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:rhui:5::el9"
],
"defaultStatus": "affected",
"packageName": "rhui5/installer-rhel9",
"product": "Red Hat Update Infrastructure 5",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786435483",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:rhui:5::el9"
],
"defaultStatus": "affected",
"packageName": "rhui5/rhua-rhel9",
"product": "Red Hat Update Infrastructure 5",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1786533529",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:rhui:5::el9"
],
"defaultStatus": "affected",
"packageName": "rhui5/cds-kubernetes-tp-rhel9",
"product": "Red Hat Update Infrastructure 5",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787241211",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:rhui:5::el9"
],
"defaultStatus": "affected",
"packageName": "rhui5/installer-tp-rhel9",
"product": "Red Hat Update Infrastructure 5",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787135742",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:rhui:5::el9"
],
"defaultStatus": "affected",
"packageName": "rhui5/rhua-tp-rhel9",
"product": "Red Hat Update Infrastructure 5",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1787241260",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "libarchive",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "libarchive",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "libarchive",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
}
],
"datePublic": "2026-05-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A double free issue has been identified in libarchive\u0027s RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-415",
"description": "Double Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T09:40:14.995Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "RHSA-2026:30333",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:30333"
},
{
"name": "RHSA-2026:52674",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:52674"
},
{
"name": "RHSA-2026:52675",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:52675"
},
{
"name": "RHSA-2026:54387",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54387"
},
{
"name": "RHSA-2026:54760",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54760"
},
{
"name": "RHSA-2026:54769",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54769"
},
{
"name": "RHSA-2026:56954",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:56954"
},
{
"name": "RHSA-2026:58558",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:58558"
},
{
"name": "RHSA-2026:58573",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:58573"
},
{
"name": "RHSA-2026:58574",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:58574"
},
{
"name": "RHSA-2026:58981",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:58981"
},
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-14164"
},
{
"name": "RHBZ#2493411",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493411"
},
{
"url": "https://github.com/libarchive/libarchive/issues/3069"
},
{
"url": "https://github.com/libarchive/libarchive/pull/3071"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-26T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-05-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()",
"workarounds": [
{
"lang": "en",
"value": "No mitigation is currently available that meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the appropriate security update once it becomes available."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-415: Double Free"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-14164",
"datePublished": "2026-06-30T06:29:23.549Z",
"dateReserved": "2026-06-30T05:30:04.144Z",
"dateUpdated": "2026-08-25T09:40:14.995Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52986 (GCVE-0-2026-52986)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack_sip: don't use simple_strtoul
Replace unsafe port parsing in epaddr_len(), ct_sip_parse_header_uri(),
and ct_sip_parse_request() with a new sip_parse_port() helper that
validates each digit against the buffer limit, eliminating the use of
simple_strtoul() which assumes NUL-terminated strings.
The previous code dereferenced pointers without bounds checks after
sip_parse_addr() and relied on simple_strtoul() on non-NUL-terminated
skb data. A port that reaches the buffer limit without a trailing
character is also rejected as malformed.
Also get rid of all simple_strtoul() usage in conntrack, prefer a
stricter version instead. There are intentional changes:
- Bail out if number is > UINT_MAX and indicate a failure, same for
too long sequences.
While we do accept 05535 as port 5535, we will not accept e.g.
'sip:10.0.0.1:005060'. While its syntactically valid under RFC 3261,
we should restrict this to not waste cycles when presented with
malformed packets with 64k '0' characters.
- Force base 10 in ct_sip_parse_numerical_param(). This is used to fetch
'expire=' and 'rports='; both are expected to use base-10.
- In nf_nat_sip.c, only accept the parsed value if its within the 1k-64k
range.
- epaddr_len now returns 0 if the port is invalid, as it already does
for invalid ip addresses. This is intentional. nf_conntrack_sip
performs lots of guesswork to find the right parts of the message
to parse. Being stricter could break existing setups.
Connection tracking helpers are designed to allow traffic to
pass, not to block it.
Based on an earlier patch from Jenny Guanni Qu <qguanni@gmail.com>.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 05e3ced297fe755093140e7487e292fb7603316e Version: 05e3ced297fe755093140e7487e292fb7603316e Version: 05e3ced297fe755093140e7487e292fb7603316e Version: 05e3ced297fe755093140e7487e292fb7603316e Version: 05e3ced297fe755093140e7487e292fb7603316e Version: 05e3ced297fe755093140e7487e292fb7603316e Version: 05e3ced297fe755093140e7487e292fb7603316e Version: 05e3ced297fe755093140e7487e292fb7603316e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_conntrack_sip.c",
"net/netfilter/nf_nat_sip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8cd0358379570003659186706e077929d6930c40",
"status": "affected",
"version": "05e3ced297fe755093140e7487e292fb7603316e",
"versionType": "git"
},
{
"lessThan": "9c6afcb1c3cbb2c0da65b8515ac14d7273872f84",
"status": "affected",
"version": "05e3ced297fe755093140e7487e292fb7603316e",
"versionType": "git"
},
{
"lessThan": "b3264c977e79d8a25778d4fd11520f00fea1329c",
"status": "affected",
"version": "05e3ced297fe755093140e7487e292fb7603316e",
"versionType": "git"
},
{
"lessThan": "ea2ecd29b8f4433e52607192ca91084f95787ca0",
"status": "affected",
"version": "05e3ced297fe755093140e7487e292fb7603316e",
"versionType": "git"
},
{
"lessThan": "9f69c323ae0ab517e595c2cc74e0ae0d9d085611",
"status": "affected",
"version": "05e3ced297fe755093140e7487e292fb7603316e",
"versionType": "git"
},
{
"lessThan": "7df9863bf538a626e8a684e59cb2c43eac0ef3c8",
"status": "affected",
"version": "05e3ced297fe755093140e7487e292fb7603316e",
"versionType": "git"
},
{
"lessThan": "523762e3b6933fff81f01dfa3c60c0774044cdab",
"status": "affected",
"version": "05e3ced297fe755093140e7487e292fb7603316e",
"versionType": "git"
},
{
"lessThan": "8cf6809cddcbe301aedfc6b51bcd4944d45795f6",
"status": "affected",
"version": "05e3ced297fe755093140e7487e292fb7603316e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_conntrack_sip.c",
"net/netfilter/nf_nat_sip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.26"
},
{
"lessThan": "2.6.26",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_sip: don\u0027t use simple_strtoul\n\nReplace unsafe port parsing in epaddr_len(), ct_sip_parse_header_uri(),\nand ct_sip_parse_request() with a new sip_parse_port() helper that\nvalidates each digit against the buffer limit, eliminating the use of\nsimple_strtoul() which assumes NUL-terminated strings.\n\nThe previous code dereferenced pointers without bounds checks after\nsip_parse_addr() and relied on simple_strtoul() on non-NUL-terminated\nskb data. A port that reaches the buffer limit without a trailing\ncharacter is also rejected as malformed.\n\nAlso get rid of all simple_strtoul() usage in conntrack, prefer a\nstricter version instead. There are intentional changes:\n\n- Bail out if number is \u003e UINT_MAX and indicate a failure, same for\n too long sequences.\n While we do accept 05535 as port 5535, we will not accept e.g.\n \u0027sip:10.0.0.1:005060\u0027. While its syntactically valid under RFC 3261,\n we should restrict this to not waste cycles when presented with\n malformed packets with 64k \u00270\u0027 characters.\n\n- Force base 10 in ct_sip_parse_numerical_param(). This is used to fetch\n \u0027expire=\u0027 and \u0027rports=\u0027; both are expected to use base-10.\n\n- In nf_nat_sip.c, only accept the parsed value if its within the 1k-64k\n range.\n\n- epaddr_len now returns 0 if the port is invalid, as it already does\n for invalid ip addresses. This is intentional. nf_conntrack_sip\n performs lots of guesswork to find the right parts of the message\n to parse. Being stricter could break existing setups.\n Connection tracking helpers are designed to allow traffic to\n pass, not to block it.\n\nBased on an earlier patch from Jenny Guanni Qu \u003cqguanni@gmail.com\u003e."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable SIP conntrack helper parses SIP payload carried in TCP/UDP network packets once the SIP helper is enabled, which is a reasonable deployment for NAT/firewall SIP gateways. A remote SIP peer can send crafted packets to that packet-processing path.\nAC:L - The trigger is a malformed numeric SIP field or URI port at the parser buffer boundary; no race or victim-controlled timing is required. Helper/NAT configuration is an environmental prerequisite, not an attacker-controlled complexity condition.\nPR:N - In the network gateway scenario, the attacker only needs to send unauthenticated SIP traffic through a system using the SIP conntrack helper. No local account or kernel privilege is required.\nUI:N - Exploitation is driven by packet processing in netfilter/conntrack. No user action is needed after the affected helper is configured.\nS:U - The impact is within the kernel/network stack security authority of the vulnerable system. It does not cross a separate scope such as guest-to-host or IOMMU isolation.\nC:H - The bug is an unbounded out-of-bounds read from non-NUL-terminated skb data via simple_strtoul and missing limit checks. Following the required guidance, an unbounded OOB read is high confidentiality impact.\nI:H - In NATed SIP paths, an out-of-bounds parser end pointer can feed attacker-influenced match lengths into NAT packet mangling, whose memmove/memcpy path lacks a bounds check against the skb payload. That creates a defensible kernel memory-corruption/code-execution risk.\nA:H - The same OOB read and possible invalid NAT mangle lengths can cause kernel faults, skb corruption, or panic. Crafted packets can be sent repeatedly, so availability impact is high."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:22.474Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8cd0358379570003659186706e077929d6930c40"
},
{
"url": "https://git.kernel.org/stable/c/9c6afcb1c3cbb2c0da65b8515ac14d7273872f84"
},
{
"url": "https://git.kernel.org/stable/c/b3264c977e79d8a25778d4fd11520f00fea1329c"
},
{
"url": "https://git.kernel.org/stable/c/ea2ecd29b8f4433e52607192ca91084f95787ca0"
},
{
"url": "https://git.kernel.org/stable/c/9f69c323ae0ab517e595c2cc74e0ae0d9d085611"
},
{
"url": "https://git.kernel.org/stable/c/7df9863bf538a626e8a684e59cb2c43eac0ef3c8"
},
{
"url": "https://git.kernel.org/stable/c/523762e3b6933fff81f01dfa3c60c0774044cdab"
},
{
"url": "https://git.kernel.org/stable/c/8cf6809cddcbe301aedfc6b51bcd4944d45795f6"
}
],
"title": "netfilter: nf_conntrack_sip: don\u0027t use simple_strtoul",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52986",
"datePublished": "2026-06-24T16:29:00.752Z",
"dateReserved": "2026-06-09T07:44:35.376Z",
"dateUpdated": "2026-08-05T12:32:22.474Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53269 (GCVE-0-2026-53269)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-06-25 08:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: synproxy: add mutex to guard hook reference counting
As the synproxy infrastructure register netfilter hooks on-demand when a
user adds the first iptables target or nftables expression, if done
concurrently they can race each other.
Introduce a mutex to serialize the refcount control blocks access from
both frontends. While a per namespace mutex might be more efficient, it
is not needed for target/expression like SYNPROXY.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ad49d86e07a497e834cb06f2b151dccd75f8e148 Version: ad49d86e07a497e834cb06f2b151dccd75f8e148 Version: ad49d86e07a497e834cb06f2b151dccd75f8e148 Version: ad49d86e07a497e834cb06f2b151dccd75f8e148 Version: ad49d86e07a497e834cb06f2b151dccd75f8e148 Version: ad49d86e07a497e834cb06f2b151dccd75f8e148 Version: ad49d86e07a497e834cb06f2b151dccd75f8e148 Version: ad49d86e07a497e834cb06f2b151dccd75f8e148 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_synproxy_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0ec9ddc1bda261a2c57636c74c8b4e53000102c9",
"status": "affected",
"version": "ad49d86e07a497e834cb06f2b151dccd75f8e148",
"versionType": "git"
},
{
"lessThan": "56ffbe3a08c01dcdb0d6adee9ce1e535bfb3b389",
"status": "affected",
"version": "ad49d86e07a497e834cb06f2b151dccd75f8e148",
"versionType": "git"
},
{
"lessThan": "debc57b83d5b323df74bf010c8d50fe26ad2ed6b",
"status": "affected",
"version": "ad49d86e07a497e834cb06f2b151dccd75f8e148",
"versionType": "git"
},
{
"lessThan": "0f8ba5e4c53d2e4a536aa68140beda9fe59b2f88",
"status": "affected",
"version": "ad49d86e07a497e834cb06f2b151dccd75f8e148",
"versionType": "git"
},
{
"lessThan": "640441348258220e78daed40528b85b8afcedab6",
"status": "affected",
"version": "ad49d86e07a497e834cb06f2b151dccd75f8e148",
"versionType": "git"
},
{
"lessThan": "aaf80701dc2f7a48fe543961e21f8ca3924d587c",
"status": "affected",
"version": "ad49d86e07a497e834cb06f2b151dccd75f8e148",
"versionType": "git"
},
{
"lessThan": "fbf0591275f50eae5733c3d7a8cd6c1e79933ffa",
"status": "affected",
"version": "ad49d86e07a497e834cb06f2b151dccd75f8e148",
"versionType": "git"
},
{
"lessThan": "2fcba19caaeb2a33017459d3430f057967bb91b6",
"status": "affected",
"version": "ad49d86e07a497e834cb06f2b151dccd75f8e148",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_synproxy_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: synproxy: add mutex to guard hook reference counting\n\nAs the synproxy infrastructure register netfilter hooks on-demand when a\nuser adds the first iptables target or nftables expression, if done\nconcurrently they can race each other.\n\nIntroduce a mutex to serialize the refcount control blocks access from\nboth frontends. While a per namespace mutex might be more efficient, it\nis not needed for target/expression like SYNPROXY."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:39:55.172Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0ec9ddc1bda261a2c57636c74c8b4e53000102c9"
},
{
"url": "https://git.kernel.org/stable/c/56ffbe3a08c01dcdb0d6adee9ce1e535bfb3b389"
},
{
"url": "https://git.kernel.org/stable/c/debc57b83d5b323df74bf010c8d50fe26ad2ed6b"
},
{
"url": "https://git.kernel.org/stable/c/0f8ba5e4c53d2e4a536aa68140beda9fe59b2f88"
},
{
"url": "https://git.kernel.org/stable/c/640441348258220e78daed40528b85b8afcedab6"
},
{
"url": "https://git.kernel.org/stable/c/aaf80701dc2f7a48fe543961e21f8ca3924d587c"
},
{
"url": "https://git.kernel.org/stable/c/fbf0591275f50eae5733c3d7a8cd6c1e79933ffa"
},
{
"url": "https://git.kernel.org/stable/c/2fcba19caaeb2a33017459d3430f057967bb91b6"
}
],
"title": "netfilter: synproxy: add mutex to guard hook reference counting",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53269",
"datePublished": "2026-06-25T08:39:55.172Z",
"dateReserved": "2026-06-09T07:44:35.395Z",
"dateUpdated": "2026-06-25T08:39:55.172Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52969 (GCVE-0-2026-52969)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-07-15 02:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: Reject wrapped offset in kvm_reset_dirty_gfn()
kvm_reset_dirty_gfn() guards the gfn range with
if (!memslot || (offset + __fls(mask)) >= memslot->npages)
return;
but offset is u64 and the addition is unchecked. The check can be
silently bypassed by a u64 wrap.
The dirty ring backing those entries is MAP_SHARED at
KVM_DIRTY_LOG_PAGE_OFFSET of the vcpu fd, so the VMM can rewrite the
slot and offset fields of any entry between when the kernel pushes
them and when KVM_RESET_DIRTY_RINGS consumes them. On reset,
kvm_dirty_ring_reset() re-reads the values via READ_ONCE() and feeds
them straight back into this check; only the flags handshake is
treated as the handover, the slot/offset payload is taken on trust.
Crafting two entries
entry[i].offset = 0xffffffffffffffc1
entry[i+1].offset = 0
makes the coalescing loop in kvm_dirty_ring_reset() compute
delta = (s64)(0 - 0xffffffffffffffc1) = 63
which falls in [0, BITS_PER_LONG), so it folds entry[i+1] into the
existing mask by setting bit 63. The trailing kvm_reset_dirty_gfn()
call then sees offset = 0xffffffffffffffc1 and __fls(mask) = 63;
the sum is 0 in u64 and the bounds check passes.
That offset propagates into kvm_arch_mmu_enable_log_dirty_pt_masked()
unchanged. On the legacy MMU path -- kvm_memslots_have_rmaps() ==
true, i.e. shadow paging, any VM that has allocated shadow roots, or
a write-tracked slot -- it reaches gfn_to_rmap(), which indexes
slot->arch.rmap[0][] with a near-U64_MAX gfn. That is an
out-of-bounds load of a kvm_rmap_head, followed by a conditional
clear of PT_WRITABLE_MASK in whatever the loaded pointer points at.
The path is reachable from any process holding /dev/kvm.
Range-check offset on its own first, so the addition cannot wrap.
memslot->npages is bounded well below U64_MAX, so once offset <
npages holds, offset + __fls(mask) (with __fls(mask) < BITS_PER_LONG)
stays in range.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: fb04a1eddb1a65b6588a021bdc132270d5ae48bb Version: fb04a1eddb1a65b6588a021bdc132270d5ae48bb Version: fb04a1eddb1a65b6588a021bdc132270d5ae48bb Version: fb04a1eddb1a65b6588a021bdc132270d5ae48bb Version: fb04a1eddb1a65b6588a021bdc132270d5ae48bb Version: fb04a1eddb1a65b6588a021bdc132270d5ae48bb Version: fb04a1eddb1a65b6588a021bdc132270d5ae48bb |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s Kernel-based Virtual Machine (KVM) component. A local attacker with access to /dev/kvm could exploit an integer overflow vulnerability in the kvm_reset_dirty_gfn() function. By manipulating dirty ring entries, the attacker can bypass a bounds check, leading to an out-of-bounds memory access. This could result in information disclosure or potentially cause a denial of service."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T02:48:28.368Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-52969"
},
{
"name": "RHBZ#2492434",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492434"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52969.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: KVM: Reject wrapped offset in kvm_reset_dirty_gfn()",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"virt/kvm/dirty_ring.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "74f1a22f7a80f03d28ad8551a2d25d563433addf",
"status": "affected",
"version": "fb04a1eddb1a65b6588a021bdc132270d5ae48bb",
"versionType": "git"
},
{
"lessThan": "0eb281eb95b2d4eea4db1da5fe91023aecc97095",
"status": "affected",
"version": "fb04a1eddb1a65b6588a021bdc132270d5ae48bb",
"versionType": "git"
},
{
"lessThan": "01b71b930f15728aa8599478a7ce90c19dcd9fc2",
"status": "affected",
"version": "fb04a1eddb1a65b6588a021bdc132270d5ae48bb",
"versionType": "git"
},
{
"lessThan": "b315b033a877b1ee6d827810b5d7bb4392ffcf8d",
"status": "affected",
"version": "fb04a1eddb1a65b6588a021bdc132270d5ae48bb",
"versionType": "git"
},
{
"lessThan": "0d419c23bb11b5c9664de777c47c1f04a235882d",
"status": "affected",
"version": "fb04a1eddb1a65b6588a021bdc132270d5ae48bb",
"versionType": "git"
},
{
"lessThan": "ecf9b3ea7847fe14f34b8c41f00de1eb95c747da",
"status": "affected",
"version": "fb04a1eddb1a65b6588a021bdc132270d5ae48bb",
"versionType": "git"
},
{
"lessThan": "577a8d3bae0531f0e5ccfac919cd8192f920a804",
"status": "affected",
"version": "fb04a1eddb1a65b6588a021bdc132270d5ae48bb",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"virt/kvm/dirty_ring.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Reject wrapped offset in kvm_reset_dirty_gfn()\n\nkvm_reset_dirty_gfn() guards the gfn range with\n\n\tif (!memslot || (offset + __fls(mask)) \u003e= memslot-\u003enpages)\n\t\treturn;\n\nbut offset is u64 and the addition is unchecked. The check can be\nsilently bypassed by a u64 wrap.\n\nThe dirty ring backing those entries is MAP_SHARED at\nKVM_DIRTY_LOG_PAGE_OFFSET of the vcpu fd, so the VMM can rewrite the\nslot and offset fields of any entry between when the kernel pushes\nthem and when KVM_RESET_DIRTY_RINGS consumes them. On reset,\nkvm_dirty_ring_reset() re-reads the values via READ_ONCE() and feeds\nthem straight back into this check; only the flags handshake is\ntreated as the handover, the slot/offset payload is taken on trust.\n\nCrafting two entries\n\n\tentry[i].offset = 0xffffffffffffffc1\n\tentry[i+1].offset = 0\n\nmakes the coalescing loop in kvm_dirty_ring_reset() compute\n\n\tdelta = (s64)(0 - 0xffffffffffffffc1) = 63\n\nwhich falls in [0, BITS_PER_LONG), so it folds entry[i+1] into the\nexisting mask by setting bit 63. The trailing kvm_reset_dirty_gfn()\ncall then sees offset = 0xffffffffffffffc1 and __fls(mask) = 63;\nthe sum is 0 in u64 and the bounds check passes.\n\nThat offset propagates into kvm_arch_mmu_enable_log_dirty_pt_masked()\nunchanged. On the legacy MMU path -- kvm_memslots_have_rmaps() ==\ntrue, i.e. shadow paging, any VM that has allocated shadow roots, or\na write-tracked slot -- it reaches gfn_to_rmap(), which indexes\nslot-\u003earch.rmap[0][] with a near-U64_MAX gfn. That is an\nout-of-bounds load of a kvm_rmap_head, followed by a conditional\nclear of PT_WRITABLE_MASK in whatever the loaded pointer points at.\nThe path is reachable from any process holding /dev/kvm.\n\nRange-check offset on its own first, so the addition cannot wrap.\nmemslot-\u003enpages is bounded well below U64_MAX, so once offset \u003c\nnpages holds, offset + __fls(mask) (with __fls(mask) \u003c BITS_PER_LONG)\nstays in range."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:28:48.085Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/74f1a22f7a80f03d28ad8551a2d25d563433addf"
},
{
"url": "https://git.kernel.org/stable/c/0eb281eb95b2d4eea4db1da5fe91023aecc97095"
},
{
"url": "https://git.kernel.org/stable/c/01b71b930f15728aa8599478a7ce90c19dcd9fc2"
},
{
"url": "https://git.kernel.org/stable/c/b315b033a877b1ee6d827810b5d7bb4392ffcf8d"
},
{
"url": "https://git.kernel.org/stable/c/0d419c23bb11b5c9664de777c47c1f04a235882d"
},
{
"url": "https://git.kernel.org/stable/c/ecf9b3ea7847fe14f34b8c41f00de1eb95c747da"
},
{
"url": "https://git.kernel.org/stable/c/577a8d3bae0531f0e5ccfac919cd8192f920a804"
}
],
"title": "KVM: Reject wrapped offset in kvm_reset_dirty_gfn()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52969",
"datePublished": "2026-06-24T16:28:48.085Z",
"dateReserved": "2026-06-09T07:44:35.375Z",
"dateUpdated": "2026-07-15T02:48:28.368Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53061 (GCVE-0-2026-53061)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-06-24 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm cache: fix dirty mapping checking in passthrough mode switching
As mentioned in commit 9b1cc9f251af ("dm cache: share cache-metadata
object across inactive and active DM tables"), dm-cache assumed table
reload occurs after suspension, while LVM's table preload breaks this
assumption. The dirty mapping check for passthrough mode was designed
around this assumption and is performed during table creation, causing
the check to fail with preload while metadata updates are ongoing. This
risks loading dirty mappings into passthrough mode, resulting in data
loss.
Reproduce steps:
1. Create a writeback cache with zero migration_threshold to produce
dirty mappings
dmsetup create cmeta --table "0 8192 linear /dev/sdc 0"
dmsetup create cdata --table "0 131072 linear /dev/sdc 8192"
dmsetup create corig --table "0 262144 linear /dev/sdc 262144"
dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct
dmsetup create cache --table "0 262144 cache /dev/mapper/cmeta \
/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writeback smq \
2 migration_threshold 0"
2. Preload a table in passthrough mode
dmsetup reload cache --table "0 262144 cache /dev/mapper/cmeta \
/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0"
3. Write to the first cache block to make it dirty
fio --filename=/dev/mapper/cache --name=populate --rw=write --bs=4k \
--direct=1 --size=64k
4. Resume the inactive table. Now it's possible to load the dirty block
into passthrough mode.
dmsetup resume cache
Fix by moving the checks to the preresume phase to support table
preloading. Also remove the unused function dm_cache_metadata_all_clean.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2ee57d587357f0d752af6c2e3e46434a74b1bee3 Version: 2ee57d587357f0d752af6c2e3e46434a74b1bee3 Version: 2ee57d587357f0d752af6c2e3e46434a74b1bee3 Version: 2ee57d587357f0d752af6c2e3e46434a74b1bee3 Version: 2ee57d587357f0d752af6c2e3e46434a74b1bee3 Version: 2ee57d587357f0d752af6c2e3e46434a74b1bee3 Version: 2ee57d587357f0d752af6c2e3e46434a74b1bee3 Version: 2ee57d587357f0d752af6c2e3e46434a74b1bee3 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-cache-metadata.c",
"drivers/md/dm-cache-metadata.h",
"drivers/md/dm-cache-target.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c2e86f647561fcf5e1c6eba7d75e9e0c4299c94d",
"status": "affected",
"version": "2ee57d587357f0d752af6c2e3e46434a74b1bee3",
"versionType": "git"
},
{
"lessThan": "5c98a3f1d7a554c9e920aa31daf92af6b5bbb8cc",
"status": "affected",
"version": "2ee57d587357f0d752af6c2e3e46434a74b1bee3",
"versionType": "git"
},
{
"lessThan": "1443c32f24d6d8bcdf4beceef2afc09290b98717",
"status": "affected",
"version": "2ee57d587357f0d752af6c2e3e46434a74b1bee3",
"versionType": "git"
},
{
"lessThan": "12105c7f18375d7615dad7605d89eadae7eb12a6",
"status": "affected",
"version": "2ee57d587357f0d752af6c2e3e46434a74b1bee3",
"versionType": "git"
},
{
"lessThan": "bd5a2c1018938e6b32670728bdb32a3f0efff00f",
"status": "affected",
"version": "2ee57d587357f0d752af6c2e3e46434a74b1bee3",
"versionType": "git"
},
{
"lessThan": "21c503d60a257e54ca3ac58e2721bd24501d5bde",
"status": "affected",
"version": "2ee57d587357f0d752af6c2e3e46434a74b1bee3",
"versionType": "git"
},
{
"lessThan": "01b22656d8a68dbeae59f8b80866e7b11936b20a",
"status": "affected",
"version": "2ee57d587357f0d752af6c2e3e46434a74b1bee3",
"versionType": "git"
},
{
"lessThan": "322586745bd1a0e5f3559fd1635fdeb4dbd1d6b8",
"status": "affected",
"version": "2ee57d587357f0d752af6c2e3e46434a74b1bee3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-cache-metadata.c",
"drivers/md/dm-cache-metadata.h",
"drivers/md/dm-cache-target.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.13"
},
{
"lessThan": "3.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm cache: fix dirty mapping checking in passthrough mode switching\n\nAs mentioned in commit 9b1cc9f251af (\"dm cache: share cache-metadata\nobject across inactive and active DM tables\"), dm-cache assumed table\nreload occurs after suspension, while LVM\u0027s table preload breaks this\nassumption. The dirty mapping check for passthrough mode was designed\naround this assumption and is performed during table creation, causing\nthe check to fail with preload while metadata updates are ongoing. This\nrisks loading dirty mappings into passthrough mode, resulting in data\nloss.\n\nReproduce steps:\n\n1. Create a writeback cache with zero migration_threshold to produce\n dirty mappings\n\ndmsetup create cmeta --table \"0 8192 linear /dev/sdc 0\"\ndmsetup create cdata --table \"0 131072 linear /dev/sdc 8192\"\ndmsetup create corig --table \"0 262144 linear /dev/sdc 262144\"\ndd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct\ndmsetup create cache --table \"0 262144 cache /dev/mapper/cmeta \\\n/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writeback smq \\\n2 migration_threshold 0\"\n\n2. Preload a table in passthrough mode\n\ndmsetup reload cache --table \"0 262144 cache /dev/mapper/cmeta \\\n/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0\"\n\n3. Write to the first cache block to make it dirty\n\nfio --filename=/dev/mapper/cache --name=populate --rw=write --bs=4k \\\n--direct=1 --size=64k\n\n4. Resume the inactive table. Now it\u0027s possible to load the dirty block\n into passthrough mode.\n\ndmsetup resume cache\n\nFix by moving the checks to the preresume phase to support table\npreloading. Also remove the unused function dm_cache_metadata_all_clean."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:05.522Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c2e86f647561fcf5e1c6eba7d75e9e0c4299c94d"
},
{
"url": "https://git.kernel.org/stable/c/5c98a3f1d7a554c9e920aa31daf92af6b5bbb8cc"
},
{
"url": "https://git.kernel.org/stable/c/1443c32f24d6d8bcdf4beceef2afc09290b98717"
},
{
"url": "https://git.kernel.org/stable/c/12105c7f18375d7615dad7605d89eadae7eb12a6"
},
{
"url": "https://git.kernel.org/stable/c/bd5a2c1018938e6b32670728bdb32a3f0efff00f"
},
{
"url": "https://git.kernel.org/stable/c/21c503d60a257e54ca3ac58e2721bd24501d5bde"
},
{
"url": "https://git.kernel.org/stable/c/01b22656d8a68dbeae59f8b80866e7b11936b20a"
},
{
"url": "https://git.kernel.org/stable/c/322586745bd1a0e5f3559fd1635fdeb4dbd1d6b8"
}
],
"title": "dm cache: fix dirty mapping checking in passthrough mode switching",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53061",
"datePublished": "2026-06-24T16:30:05.522Z",
"dateReserved": "2026-06-09T07:44:35.382Z",
"dateUpdated": "2026-06-24T16:30:05.522Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53314 (GCVE-0-2026-53314)
Vulnerability from cvelistv5
Published
2026-06-26 19:41
Modified
2026-06-26 19:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
padata: Put CPU offline callback in ONLINE section to allow failure
syzbot reported the following warning:
DEAD callback error for CPU1
WARNING: kernel/cpu.c:1463 at _cpu_down+0x759/0x1020 kernel/cpu.c:1463, CPU#0: syz.0.1960/14614
at commit 4ae12d8bd9a8 ("Merge tag 'kbuild-fixes-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux")
which tglx traced to padata_cpu_dead() given it's the only
sub-CPUHP_TEARDOWN_CPU callback that returns an error.
Failure isn't allowed in hotplug states before CPUHP_TEARDOWN_CPU
so move the CPU offline callback to the ONLINE section where failure is
possible.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 894c9ef9780c5cf2f143415e867ee39a33ecb75d Version: 894c9ef9780c5cf2f143415e867ee39a33ecb75d Version: 894c9ef9780c5cf2f143415e867ee39a33ecb75d Version: 894c9ef9780c5cf2f143415e867ee39a33ecb75d Version: 894c9ef9780c5cf2f143415e867ee39a33ecb75d Version: 894c9ef9780c5cf2f143415e867ee39a33ecb75d Version: 2b1207801c393a5e9af2fbac2dd8b0377d8ae63a Version: 0685dfa0a2ff7635c0b64f7b7f0fafbf1c3e0c14 Version: 3f4d3d010477365ee1aefedc3ad52563740b777e Version: 4.19.202 ≤ Version: 5.4.22 ≤ Version: 5.5.6 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/cpuhotplug.h",
"include/linux/padata.h",
"kernel/padata.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "65dae8b34f0810f3fa9f77c4c63650cd20820693",
"status": "affected",
"version": "894c9ef9780c5cf2f143415e867ee39a33ecb75d",
"versionType": "git"
},
{
"lessThan": "a6d44f477000c6352de6b05e9e276e62083e5fbf",
"status": "affected",
"version": "894c9ef9780c5cf2f143415e867ee39a33ecb75d",
"versionType": "git"
},
{
"lessThan": "3e6c08dd97dcd22a00aee469e0adfa819071d80e",
"status": "affected",
"version": "894c9ef9780c5cf2f143415e867ee39a33ecb75d",
"versionType": "git"
},
{
"lessThan": "5a9f29a3e076b637d2234093e57989cf755ded5b",
"status": "affected",
"version": "894c9ef9780c5cf2f143415e867ee39a33ecb75d",
"versionType": "git"
},
{
"lessThan": "9afe53f14a2aae8c4beb30e5ea51641a34f1a3d3",
"status": "affected",
"version": "894c9ef9780c5cf2f143415e867ee39a33ecb75d",
"versionType": "git"
},
{
"lessThan": "c8c4a2972f83c8b68ff03b43cecdb898939ff851",
"status": "affected",
"version": "894c9ef9780c5cf2f143415e867ee39a33ecb75d",
"versionType": "git"
},
{
"status": "affected",
"version": "2b1207801c393a5e9af2fbac2dd8b0377d8ae63a",
"versionType": "git"
},
{
"status": "affected",
"version": "0685dfa0a2ff7635c0b64f7b7f0fafbf1c3e0c14",
"versionType": "git"
},
{
"status": "affected",
"version": "3f4d3d010477365ee1aefedc3ad52563740b777e",
"versionType": "git"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.202",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.22",
"versionType": "semver"
},
{
"lessThan": "5.6",
"status": "affected",
"version": "5.5.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/cpuhotplug.h",
"include/linux/padata.h",
"kernel/padata.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.202",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npadata: Put CPU offline callback in ONLINE section to allow failure\n\nsyzbot reported the following warning:\n\n DEAD callback error for CPU1\n WARNING: kernel/cpu.c:1463 at _cpu_down+0x759/0x1020 kernel/cpu.c:1463, CPU#0: syz.0.1960/14614\n\nat commit 4ae12d8bd9a8 (\"Merge tag \u0027kbuild-fixes-7.0-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux\")\nwhich tglx traced to padata_cpu_dead() given it\u0027s the only\nsub-CPUHP_TEARDOWN_CPU callback that returns an error.\n\nFailure isn\u0027t allowed in hotplug states before CPUHP_TEARDOWN_CPU\nso move the CPU offline callback to the ONLINE section where failure is\npossible."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-26T19:41:07.447Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/65dae8b34f0810f3fa9f77c4c63650cd20820693"
},
{
"url": "https://git.kernel.org/stable/c/a6d44f477000c6352de6b05e9e276e62083e5fbf"
},
{
"url": "https://git.kernel.org/stable/c/3e6c08dd97dcd22a00aee469e0adfa819071d80e"
},
{
"url": "https://git.kernel.org/stable/c/5a9f29a3e076b637d2234093e57989cf755ded5b"
},
{
"url": "https://git.kernel.org/stable/c/9afe53f14a2aae8c4beb30e5ea51641a34f1a3d3"
},
{
"url": "https://git.kernel.org/stable/c/c8c4a2972f83c8b68ff03b43cecdb898939ff851"
}
],
"title": "padata: Put CPU offline callback in ONLINE section to allow failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53314",
"datePublished": "2026-06-26T19:41:07.447Z",
"dateReserved": "2026-06-09T07:44:35.397Z",
"dateUpdated": "2026-06-26T19:41:07.447Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52933 (GCVE-0-2026-52933)
Vulnerability from cvelistv5
Published
2026-06-24 07:14
Modified
2026-08-05 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
io_uring/poll: fix signed comparison in io_poll_get_ownership()
io_poll_get_ownership() uses a signed comparison to check whether
poll_refs has reached the threshold for the slowpath:
if (unlikely(atomic_read(&req->poll_refs) >= IO_POLL_REF_BIAS))
atomic_read() returns int (signed). When IO_POLL_CANCEL_FLAG
(BIT(31)) is set in poll_refs, the value becomes negative in
signed arithmetic, so the >= 128 comparison always evaluates to
false and the slowpath is never taken.
Fix this by casting the atomic_read() result to unsigned int
before the comparison, so that the cancel flag is treated as a
large positive value and correctly triggers the slowpath.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a26a35e9019fd70bf3cf647dcfdae87abc7bacea Version: a26a35e9019fd70bf3cf647dcfdae87abc7bacea Version: a26a35e9019fd70bf3cf647dcfdae87abc7bacea Version: a26a35e9019fd70bf3cf647dcfdae87abc7bacea Version: a26a35e9019fd70bf3cf647dcfdae87abc7bacea Version: a26a35e9019fd70bf3cf647dcfdae87abc7bacea Version: 4b702b7d11ce1b9d26fc6d7c5a7ef4ac1d455048 Version: bc4e6ee16778149811333a969a7a893d4cc110c5 Version: 5.15.82 ≤ Version: 6.0.11 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"io_uring/poll.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "81bf96b0abbfa4cd47ea32e12596aed3855fb2f3",
"status": "affected",
"version": "a26a35e9019fd70bf3cf647dcfdae87abc7bacea",
"versionType": "git"
},
{
"lessThan": "cf522703d4f194991615763697ae25a3f9539763",
"status": "affected",
"version": "a26a35e9019fd70bf3cf647dcfdae87abc7bacea",
"versionType": "git"
},
{
"lessThan": "fc47043f3d9af3efa407665b47f8378ec691ba18",
"status": "affected",
"version": "a26a35e9019fd70bf3cf647dcfdae87abc7bacea",
"versionType": "git"
},
{
"lessThan": "ea0697129807d718037f618221037aa0660ee3c5",
"status": "affected",
"version": "a26a35e9019fd70bf3cf647dcfdae87abc7bacea",
"versionType": "git"
},
{
"lessThan": "c6d191164dc81838d8dbf452a6000f68c558d1ae",
"status": "affected",
"version": "a26a35e9019fd70bf3cf647dcfdae87abc7bacea",
"versionType": "git"
},
{
"lessThan": "326941b22806cbf2df1fbfe902b7908b368cce42",
"status": "affected",
"version": "a26a35e9019fd70bf3cf647dcfdae87abc7bacea",
"versionType": "git"
},
{
"status": "affected",
"version": "4b702b7d11ce1b9d26fc6d7c5a7ef4ac1d455048",
"versionType": "git"
},
{
"status": "affected",
"version": "bc4e6ee16778149811333a969a7a893d4cc110c5",
"versionType": "git"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.82",
"versionType": "semver"
},
{
"lessThan": "6.1",
"status": "affected",
"version": "6.0.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"io_uring/poll.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.0.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/poll: fix signed comparison in io_poll_get_ownership()\n\nio_poll_get_ownership() uses a signed comparison to check whether\npoll_refs has reached the threshold for the slowpath:\n\n if (unlikely(atomic_read(\u0026req-\u003epoll_refs) \u003e= IO_POLL_REF_BIAS))\n\natomic_read() returns int (signed). When IO_POLL_CANCEL_FLAG\n(BIT(31)) is set in poll_refs, the value becomes negative in\nsigned arithmetic, so the \u003e= 128 comparison always evaluates to\nfalse and the slowpath is never taken.\n\nFix this by casting the atomic_read() result to unsigned int\nbefore the comparison, so that the cancel flag is treated as a\nlarge positive value and correctly triggers the slowpath."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached by local `io_uring_setup()`/`io_uring_enter()` submissions of poll and cancel operations, not by remote packets or physical access.\nAC:L - An attacker can create the ring, choose pollable file descriptors, submit cancels/removes, and generate concurrent wakeups; the race participants are attacker-controlled.\nPR:L - With the default `io_uring_disabled=0`, an unprivileged local user can create and use io_uring; no real root or init-namespace capability is required.\nUI:N - Exploitation does not require another user to mount, open, or process anything; the attacker drives the syscall and file-descriptor activity directly.\nS:U - This is a kernel request-lifetime/ownership bug within the same host kernel security authority, not a VM, IOMMU, or separate security-scope escape.\nC:H - The signedness bug defeats the poll_refs overflow/ownership slow path after cancellation, allowing ref-bit wrap and duplicate ownership/completion of an `io_kiocb`; that is UAF-style kernel memory corruption with plausible memory disclosure.\nI:H - The same duplicate ownership/completion and request lifetime corruption can plausibly be shaped into arbitrary kernel memory modification or control-flow compromise, so integrity impact is high.\nA:H - At minimum, corrupted poll ownership and duplicate completion can trigger kernel warnings, NULL dereferences, UAF crashes, or hangs in a local attacker-controlled loop."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:51.192Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/81bf96b0abbfa4cd47ea32e12596aed3855fb2f3"
},
{
"url": "https://git.kernel.org/stable/c/cf522703d4f194991615763697ae25a3f9539763"
},
{
"url": "https://git.kernel.org/stable/c/fc47043f3d9af3efa407665b47f8378ec691ba18"
},
{
"url": "https://git.kernel.org/stable/c/ea0697129807d718037f618221037aa0660ee3c5"
},
{
"url": "https://git.kernel.org/stable/c/c6d191164dc81838d8dbf452a6000f68c558d1ae"
},
{
"url": "https://git.kernel.org/stable/c/326941b22806cbf2df1fbfe902b7908b368cce42"
}
],
"title": "io_uring/poll: fix signed comparison in io_poll_get_ownership()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52933",
"datePublished": "2026-06-24T07:14:24.678Z",
"dateReserved": "2026-06-09T07:44:35.369Z",
"dateUpdated": "2026-08-05T12:31:51.192Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53343 (GCVE-0-2026-53343)
Vulnerability from cvelistv5
Published
2026-07-01 13:32
Modified
2026-07-01 13:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow
Commit 44e9a3bb76e5 ("ARM: 9430/1: entry: Do a dummy read from
VMAP shadow") added a dummy read from the KASAN VMAP stack shadow in
__switch_to(). The read uses ldr, but the KASAN shadow address is
byte-granular and is not guaranteed to be word aligned.
ARMv5 faults unaligned word loads. With CONFIG_KASAN_VMALLOC and
CONFIG_VMAP_STACK enabled, ARM926/VersatilePB crashes in __switch_to()
with an alignment exception before reaching init.
Use ldrb for the dummy shadow access. The code only needs to fault in the
shadow mapping if the stack shadow is missing, so a byte load is sufficient
and matches the granularity of KASAN shadow memory.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8fe148d39c127de3fb78dfa6da95a3608dfda454 Version: ef21187c0672a2b2cbec44f33bab9ec47d5c277c Version: c86d26b4b089ca294b3b7d915a7da61edb77935f Version: 44e9a3bb76e5f2eecd374c8176b2c5163c8bb2e2 Version: 44e9a3bb76e5f2eecd374c8176b2c5163c8bb2e2 Version: 44e9a3bb76e5f2eecd374c8176b2c5163c8bb2e2 Version: 6.1.120 ≤ Version: 6.6.64 ≤ Version: 6.12.4 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm/kernel/entry-armv.S"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c0b8c148a7754826156993ed6442d31536ec86b4",
"status": "affected",
"version": "8fe148d39c127de3fb78dfa6da95a3608dfda454",
"versionType": "git"
},
{
"lessThan": "c2e3aadc8fef7da068490597fc5582f8f362aeb2",
"status": "affected",
"version": "ef21187c0672a2b2cbec44f33bab9ec47d5c277c",
"versionType": "git"
},
{
"lessThan": "c74990828d3c486ee44aaa68240eb3abff289d1c",
"status": "affected",
"version": "c86d26b4b089ca294b3b7d915a7da61edb77935f",
"versionType": "git"
},
{
"lessThan": "517720913bd3c17a52cd55a740064f68455ab88e",
"status": "affected",
"version": "44e9a3bb76e5f2eecd374c8176b2c5163c8bb2e2",
"versionType": "git"
},
{
"lessThan": "2a4dc9a0ac3326e79fb58fdaae724b92127709a9",
"status": "affected",
"version": "44e9a3bb76e5f2eecd374c8176b2c5163c8bb2e2",
"versionType": "git"
},
{
"lessThan": "77a1f6883dc6e837bb2cb30b9b02e2f94338e2c6",
"status": "affected",
"version": "44e9a3bb76e5f2eecd374c8176b2c5163c8bb2e2",
"versionType": "git"
},
{
"lessThan": "6.1.176",
"status": "affected",
"version": "6.1.120",
"versionType": "semver"
},
{
"lessThan": "6.6.143",
"status": "affected",
"version": "6.6.64",
"versionType": "semver"
},
{
"lessThan": "6.12.94",
"status": "affected",
"version": "6.12.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm/kernel/entry-armv.S"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "6.1.120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "6.6.64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "6.12.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow\n\nCommit 44e9a3bb76e5 (\"ARM: 9430/1: entry: Do a dummy read from\nVMAP shadow\") added a dummy read from the KASAN VMAP stack shadow in\n__switch_to(). The read uses ldr, but the KASAN shadow address is\nbyte-granular and is not guaranteed to be word aligned.\n\nARMv5 faults unaligned word loads. With CONFIG_KASAN_VMALLOC and\nCONFIG_VMAP_STACK enabled, ARM926/VersatilePB crashes in __switch_to()\nwith an alignment exception before reaching init.\n\nUse ldrb for the dummy shadow access. The code only needs to fault in the\nshadow mapping if the stack shadow is missing, so a byte load is sufficient\nand matches the granularity of KASAN shadow memory."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T13:32:23.979Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c0b8c148a7754826156993ed6442d31536ec86b4"
},
{
"url": "https://git.kernel.org/stable/c/c2e3aadc8fef7da068490597fc5582f8f362aeb2"
},
{
"url": "https://git.kernel.org/stable/c/c74990828d3c486ee44aaa68240eb3abff289d1c"
},
{
"url": "https://git.kernel.org/stable/c/517720913bd3c17a52cd55a740064f68455ab88e"
},
{
"url": "https://git.kernel.org/stable/c/2a4dc9a0ac3326e79fb58fdaae724b92127709a9"
},
{
"url": "https://git.kernel.org/stable/c/77a1f6883dc6e837bb2cb30b9b02e2f94338e2c6"
}
],
"title": "ARM: 9475/1: entry: use byte load for KASAN VMAP stack shadow",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53343",
"datePublished": "2026-07-01T13:32:23.979Z",
"dateReserved": "2026-06-09T07:44:35.399Z",
"dateUpdated": "2026-07-01T13:32:23.979Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12413 (GCVE-0-2026-12413)
Vulnerability from cvelistv5
Published
2026-07-02 21:19
Modified
2026-07-07 17:02
Severity ?
VLAI Severity ?
EPSS score ?
Summary
An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemble_v2_incoming_fragments() would ignore unknown outer payloads but still store these in a fixed size array msg_digest.digest[PAYLIMIT]. An off-by-one error in the assertion PASSERT(logger, md->digest_roof < elemsof(md->digest)) causes the daemon to abort. No remote code execution is possible. Any configuration that allows IKEv2 connections that do not set fragmentation=no are vulnerable. IKEv1 is not affected.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| The Libreswan Project | libreswan |
Version: 4.6 ≤ 5.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12413",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-06T18:12:21.499364Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-07T17:02:12.976Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "libreswan",
"vendor": "The Libreswan Project",
"versions": [
{
"lessThanOrEqual": "5.3",
"status": "affected",
"version": "4.6",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.3.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Hu Xinyao"
}
],
"descriptions": [
{
"lang": "en",
"value": "An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemble_v2_incoming_fragments() would ignore unknown outer payloads but still store these in a fixed size array msg_digest.digest[PAYLIMIT]. An off-by-one error in the assertion PASSERT(logger, md-\u003edigest_roof \u003c elemsof(md-\u003edigest)) causes the daemon to abort. No remote code execution is possible. Any configuration that allows IKEv2 connections that do not set fragmentation=no are vulnerable. IKEv1 is not affected."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"other": {
"content": {
"description": "Vendor-assessed severity. The daemon automatically restarts after the crash, requiring continued exploitation for sustained denial of service.",
"value": "MEDIUM"
},
"type": "vendorSeverity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-193",
"description": "Off-by-one Error",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-617",
"description": "Reachable Assertion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-02T21:19:22.177Z",
"orgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
"shortName": "libreswan"
},
"references": [
{
"name": "Libreswan Security Advisory",
"url": "https://libreswan.org/security/CVE-2026-12413/CVE-2026-12413.txt"
},
{
"name": "Libreswan CVE-2026-12413 Patches",
"url": "https://libreswan.org/security/CVE-2026-12413/"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to libreswan 5.3.1 or later. Patches for libreswan 4.15 and 5.3 are available at https://libreswan.org"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-16T00:00:00.000Z",
"value": "Libreswan notified of the issue via security@libreswan.org"
},
{
"lang": "en",
"time": "2026-06-16T00:00:00.000Z",
"value": "Advanced notice given to supported customers and distributions"
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Public announcement and release of libreswan 5.3.1"
}
],
"title": "IKEv2 Denial of Service via malformed fragmentation",
"workarounds": [
{
"lang": "en",
"value": "If fragmentation is not needed, fragmentation=no can be added to all IKEv2 configurations. If fragmentation is needed, no workaround is possible and the fix needs to be applied."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
"assignerShortName": "libreswan",
"cveId": "CVE-2026-12413",
"datePublished": "2026-07-02T21:19:22.177Z",
"dateReserved": "2026-06-16T15:52:12.674Z",
"dateUpdated": "2026-07-07T17:02:12.976Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53047 (GCVE-0-2026-53047)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-06-24 16:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
efi/capsule-loader: fix incorrect sizeof in phys array reallocation
The krealloc() call for cap_info->phys in __efi_capsule_setup_info() uses
sizeof(phys_addr_t *) instead of sizeof(phys_addr_t), which might be
causing an undersized allocation.
The allocation is also inconsistent with the initial array allocation in
efi_capsule_open() that allocates one entry with sizeof(phys_addr_t),
and the efi_capsule_write() function that stores phys_addr_t values (not
pointers) via page_to_phys().
On 64-bit systems where sizeof(phys_addr_t) == sizeof(phys_addr_t *), this
goes unnoticed. On 32-bit systems with PAE where phys_addr_t is 64-bit but
pointers are 32-bit, this allocates half the required space, which might
lead to a heap buffer overflow when storing physical addresses.
This is similar to the bug fixed in commit fccfa646ef36 ("efi/capsule-loader:
fix incorrect allocation size") which fixed the same issue at the initial
allocation site.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f24c4d478013d82bd1b943df566fff3561d52864 Version: f24c4d478013d82bd1b943df566fff3561d52864 Version: f24c4d478013d82bd1b943df566fff3561d52864 Version: f24c4d478013d82bd1b943df566fff3561d52864 Version: f24c4d478013d82bd1b943df566fff3561d52864 Version: f24c4d478013d82bd1b943df566fff3561d52864 Version: f24c4d478013d82bd1b943df566fff3561d52864 Version: f24c4d478013d82bd1b943df566fff3561d52864 Version: 95a362c9a6892085f714eb6e31eea6a0e3aa93bf Version: 4.14.13 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/firmware/efi/capsule-loader.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "22022cd8851703a58f67615a17bc7e9e8682785b",
"status": "affected",
"version": "f24c4d478013d82bd1b943df566fff3561d52864",
"versionType": "git"
},
{
"lessThan": "67adde6bfdfd563a54b045d59aeb9a2d90c80697",
"status": "affected",
"version": "f24c4d478013d82bd1b943df566fff3561d52864",
"versionType": "git"
},
{
"lessThan": "608e1f7bc9d171ab26c1fba288c97fc76363c27d",
"status": "affected",
"version": "f24c4d478013d82bd1b943df566fff3561d52864",
"versionType": "git"
},
{
"lessThan": "8be69e9245f805566bac68ffc8574b64735fd996",
"status": "affected",
"version": "f24c4d478013d82bd1b943df566fff3561d52864",
"versionType": "git"
},
{
"lessThan": "5e185330d902b12fe8e6eb4b8514b5d736d8d66d",
"status": "affected",
"version": "f24c4d478013d82bd1b943df566fff3561d52864",
"versionType": "git"
},
{
"lessThan": "e0e6b14995fd6fa2c0df8c712d76ab32f0694c31",
"status": "affected",
"version": "f24c4d478013d82bd1b943df566fff3561d52864",
"versionType": "git"
},
{
"lessThan": "ab3f7098a3a27175b91cfc947950f5c26855801b",
"status": "affected",
"version": "f24c4d478013d82bd1b943df566fff3561d52864",
"versionType": "git"
},
{
"lessThan": "48a428215782321b56956974f23593e40ce84b7a",
"status": "affected",
"version": "f24c4d478013d82bd1b943df566fff3561d52864",
"versionType": "git"
},
{
"status": "affected",
"version": "95a362c9a6892085f714eb6e31eea6a0e3aa93bf",
"versionType": "git"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.13",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/firmware/efi/capsule-loader.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nefi/capsule-loader: fix incorrect sizeof in phys array reallocation\n\nThe krealloc() call for cap_info-\u003ephys in __efi_capsule_setup_info() uses\nsizeof(phys_addr_t *) instead of sizeof(phys_addr_t), which might be\ncausing an undersized allocation.\n\nThe allocation is also inconsistent with the initial array allocation in\nefi_capsule_open() that allocates one entry with sizeof(phys_addr_t),\nand the efi_capsule_write() function that stores phys_addr_t values (not\npointers) via page_to_phys().\n\nOn 64-bit systems where sizeof(phys_addr_t) == sizeof(phys_addr_t *), this\ngoes unnoticed. On 32-bit systems with PAE where phys_addr_t is 64-bit but\npointers are 32-bit, this allocates half the required space, which might\nlead to a heap buffer overflow when storing physical addresses.\n\nThis is similar to the bug fixed in commit fccfa646ef36 (\"efi/capsule-loader:\nfix incorrect allocation size\") which fixed the same issue at the initial\nallocation site."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:29:53.491Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/22022cd8851703a58f67615a17bc7e9e8682785b"
},
{
"url": "https://git.kernel.org/stable/c/67adde6bfdfd563a54b045d59aeb9a2d90c80697"
},
{
"url": "https://git.kernel.org/stable/c/608e1f7bc9d171ab26c1fba288c97fc76363c27d"
},
{
"url": "https://git.kernel.org/stable/c/8be69e9245f805566bac68ffc8574b64735fd996"
},
{
"url": "https://git.kernel.org/stable/c/5e185330d902b12fe8e6eb4b8514b5d736d8d66d"
},
{
"url": "https://git.kernel.org/stable/c/e0e6b14995fd6fa2c0df8c712d76ab32f0694c31"
},
{
"url": "https://git.kernel.org/stable/c/ab3f7098a3a27175b91cfc947950f5c26855801b"
},
{
"url": "https://git.kernel.org/stable/c/48a428215782321b56956974f23593e40ce84b7a"
}
],
"title": "efi/capsule-loader: fix incorrect sizeof in phys array reallocation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53047",
"datePublished": "2026-06-24T16:29:53.491Z",
"dateReserved": "2026-06-09T07:44:35.381Z",
"dateUpdated": "2026-06-24T16:29:53.491Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53023 (GCVE-0-2026-53023)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-06-24 16:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: terminate the cached volume label after UTF-8 conversion
ntfs_fill_super() loads the on-disk volume label with utf16s_to_utf8s()
and stores the result in sbi->volume.label. The converted label is later
exposed through ntfs3_label_show() using %s, but utf16s_to_utf8s() only
returns the number of bytes written and does not add a trailing NUL.
If the converted label fills the entire fixed buffer,
ntfs3_label_show() can read past the end of sbi->volume.label while
looking for a terminator.
Terminate the cached label explicitly after a successful conversion and
clamp the exact-full case to the last byte of the buffer.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 82cae269cfa953032fbb8980a7d554d60fb00b17 Version: 82cae269cfa953032fbb8980a7d554d60fb00b17 Version: 82cae269cfa953032fbb8980a7d554d60fb00b17 Version: 82cae269cfa953032fbb8980a7d554d60fb00b17 Version: 82cae269cfa953032fbb8980a7d554d60fb00b17 Version: 82cae269cfa953032fbb8980a7d554d60fb00b17 Version: 82cae269cfa953032fbb8980a7d554d60fb00b17 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ntfs3/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "32b0686369e0afbb3549a0d93e2d8517da84cd30",
"status": "affected",
"version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
"versionType": "git"
},
{
"lessThan": "bc7a0c34c4ca259cfddf3bc18fc5b3c6411d26ed",
"status": "affected",
"version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
"versionType": "git"
},
{
"lessThan": "0b11fcbe80a59acdf58337d80ebb5f72201d73d6",
"status": "affected",
"version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
"versionType": "git"
},
{
"lessThan": "54d564b762389679e2f8fb9eeb20af7e82371e1c",
"status": "affected",
"version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
"versionType": "git"
},
{
"lessThan": "6136bbb054f7ab9f51ae99915541633b18bcef90",
"status": "affected",
"version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
"versionType": "git"
},
{
"lessThan": "5cd0707b81cb4589f00aec5c4c1288bd0980d2a4",
"status": "affected",
"version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
"versionType": "git"
},
{
"lessThan": "a6cd43fe9b083fa23fe1595666d5738856cb261a",
"status": "affected",
"version": "82cae269cfa953032fbb8980a7d554d60fb00b17",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ntfs3/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: terminate the cached volume label after UTF-8 conversion\n\nntfs_fill_super() loads the on-disk volume label with utf16s_to_utf8s()\nand stores the result in sbi-\u003evolume.label. The converted label is later\nexposed through ntfs3_label_show() using %s, but utf16s_to_utf8s() only\nreturns the number of bytes written and does not add a trailing NUL.\n\nIf the converted label fills the entire fixed buffer,\nntfs3_label_show() can read past the end of sbi-\u003evolume.label while\nlooking for a terminator.\n\nTerminate the cached label explicitly after a successful conversion and\nclamp the exact-full case to the last byte of the buffer."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:29:32.440Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/32b0686369e0afbb3549a0d93e2d8517da84cd30"
},
{
"url": "https://git.kernel.org/stable/c/bc7a0c34c4ca259cfddf3bc18fc5b3c6411d26ed"
},
{
"url": "https://git.kernel.org/stable/c/0b11fcbe80a59acdf58337d80ebb5f72201d73d6"
},
{
"url": "https://git.kernel.org/stable/c/54d564b762389679e2f8fb9eeb20af7e82371e1c"
},
{
"url": "https://git.kernel.org/stable/c/6136bbb054f7ab9f51ae99915541633b18bcef90"
},
{
"url": "https://git.kernel.org/stable/c/5cd0707b81cb4589f00aec5c4c1288bd0980d2a4"
},
{
"url": "https://git.kernel.org/stable/c/a6cd43fe9b083fa23fe1595666d5738856cb261a"
}
],
"title": "fs/ntfs3: terminate the cached volume label after UTF-8 conversion",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53023",
"datePublished": "2026-06-24T16:29:32.440Z",
"dateReserved": "2026-06-09T07:44:35.379Z",
"dateUpdated": "2026-06-24T16:29:32.440Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52984 (GCVE-0-2026-52984)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-06-24 16:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: netem: fix queue limit check to include reordered packets
The queue limit check in netem_enqueue() uses q->t_len which only
counts packets in the internal tfifo. Packets placed in sch->q by
the reorder path (__qdisc_enqueue_head) are not counted, allowing
the total queue occupancy to exceed sch->limit under reordering.
Include sch->q.qlen in the limit check.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 216509dda290f6db92c816dd54b83c1df9da9e76 Version: c2047b0e216c8edce227d7c42f99ac2877dad0e4 Version: 10df49cfca73dfbbdb6c4150d859f7e8926ae427 Version: 3824c5fad18eeb7abe0c4fc966f29959552dca3e Version: 356078a5c55ec8d2061fcc009fb8599f5b0527f9 Version: f8d4bc455047cf3903cd6f85f49978987dbb3027 Version: f8d4bc455047cf3903cd6f85f49978987dbb3027 Version: f8d4bc455047cf3903cd6f85f49978987dbb3027 Version: 83c6ab12f08dcc09d4c5ac86fdb89736b28f1d31 Version: 5.10.232 ≤ Version: 5.15.175 ≤ Version: 6.1.121 ≤ Version: 6.6.67 ≤ Version: 6.12.6 ≤ Version: 5.4.288 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/sch_netem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0f875d52db4c921da610e481b72f03cc82fdcb72",
"status": "affected",
"version": "216509dda290f6db92c816dd54b83c1df9da9e76",
"versionType": "git"
},
{
"lessThan": "ef9a41b3870fb90577da5b2de5bd140022d4021e",
"status": "affected",
"version": "c2047b0e216c8edce227d7c42f99ac2877dad0e4",
"versionType": "git"
},
{
"lessThan": "74fcd8e127200a50ee22ba2b45c164722bdb9177",
"status": "affected",
"version": "10df49cfca73dfbbdb6c4150d859f7e8926ae427",
"versionType": "git"
},
{
"lessThan": "39a66e83ea41fe845631eeb8d326953de27d13f9",
"status": "affected",
"version": "3824c5fad18eeb7abe0c4fc966f29959552dca3e",
"versionType": "git"
},
{
"lessThan": "54b5dbacd00dedffd5e2eed76de1c3839996b5e6",
"status": "affected",
"version": "356078a5c55ec8d2061fcc009fb8599f5b0527f9",
"versionType": "git"
},
{
"lessThan": "8450462eaf91d5d2a9e863507b16d18e814baef3",
"status": "affected",
"version": "f8d4bc455047cf3903cd6f85f49978987dbb3027",
"versionType": "git"
},
{
"lessThan": "936a7dd87251f6f3e88983350833edf60fe6a80b",
"status": "affected",
"version": "f8d4bc455047cf3903cd6f85f49978987dbb3027",
"versionType": "git"
},
{
"lessThan": "4185701fcce6b426b6c3630b25330dddd9c47b0d",
"status": "affected",
"version": "f8d4bc455047cf3903cd6f85f49978987dbb3027",
"versionType": "git"
},
{
"status": "affected",
"version": "83c6ab12f08dcc09d4c5ac86fdb89736b28f1d31",
"versionType": "git"
},
{
"lessThan": "5.10.258",
"status": "affected",
"version": "5.10.232",
"versionType": "semver"
},
{
"lessThan": "5.15.209",
"status": "affected",
"version": "5.15.175",
"versionType": "semver"
},
{
"lessThan": "6.1.175",
"status": "affected",
"version": "6.1.121",
"versionType": "semver"
},
{
"lessThan": "6.6.141",
"status": "affected",
"version": "6.6.67",
"versionType": "semver"
},
{
"lessThan": "6.12.91",
"status": "affected",
"version": "6.12.6",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.288",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/sch_netem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.10.232",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.15.175",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1.121",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "6.6.67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.12.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.288",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: netem: fix queue limit check to include reordered packets\n\nThe queue limit check in netem_enqueue() uses q-\u003et_len which only\ncounts packets in the internal tfifo. Packets placed in sch-\u003eq by\nthe reorder path (__qdisc_enqueue_head) are not counted, allowing\nthe total queue occupancy to exceed sch-\u003elimit under reordering.\n\nInclude sch-\u003eq.qlen in the limit check."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:28:59.088Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0f875d52db4c921da610e481b72f03cc82fdcb72"
},
{
"url": "https://git.kernel.org/stable/c/ef9a41b3870fb90577da5b2de5bd140022d4021e"
},
{
"url": "https://git.kernel.org/stable/c/74fcd8e127200a50ee22ba2b45c164722bdb9177"
},
{
"url": "https://git.kernel.org/stable/c/39a66e83ea41fe845631eeb8d326953de27d13f9"
},
{
"url": "https://git.kernel.org/stable/c/54b5dbacd00dedffd5e2eed76de1c3839996b5e6"
},
{
"url": "https://git.kernel.org/stable/c/8450462eaf91d5d2a9e863507b16d18e814baef3"
},
{
"url": "https://git.kernel.org/stable/c/936a7dd87251f6f3e88983350833edf60fe6a80b"
},
{
"url": "https://git.kernel.org/stable/c/4185701fcce6b426b6c3630b25330dddd9c47b0d"
}
],
"title": "net/sched: netem: fix queue limit check to include reordered packets",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52984",
"datePublished": "2026-06-24T16:28:59.088Z",
"dateReserved": "2026-06-09T07:44:35.376Z",
"dateUpdated": "2026-06-24T16:28:59.088Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53289 (GCVE-0-2026-53289)
Vulnerability from cvelistv5
Published
2026-06-26 19:40
Modified
2026-06-26 19:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ice: fix NULL pointer dereference in ice_reset_all_vfs()
ice_reset_all_vfs() ignores the return value of ice_vf_rebuild_vsi().
When the VSI rebuild fails (e.g. during NVM firmware update via
nvmupdate64e), ice_vsi_rebuild() tears down the VSI on its error path,
leaving txq_map and rxq_map as NULL. The subsequent unconditional call
to ice_vf_post_vsi_rebuild() leads to a NULL pointer dereference in
ice_ena_vf_q_mappings() when it accesses vsi->txq_map[0].
The single-VF reset path in ice_reset_vf() already handles this
correctly by checking the return value of ice_vf_reconfig_vsi() and
skipping ice_vf_post_vsi_rebuild() on failure.
Apply the same pattern to ice_reset_all_vfs(): check the return value
of ice_vf_rebuild_vsi() and skip ice_vf_post_vsi_rebuild() and
ice_eswitch_attach_vf() on failure. The VF is left safely disabled
(ICE_VF_STATE_INIT not set, VFGEN_RSTAT not set to VFACTIVE) and can
be recovered via a VFLR triggered by a PCI reset of the VF
(sysfs reset or driver rebind).
Note that this patch does not prevent the VF VSI rebuild from failing
during NVM update — the underlying cause is firmware being in a
transitional state while the EMP reset is processed, which can cause
Admin Queue commands (ice_add_vsi, ice_cfg_vsi_lan) to fail. This
patch only prevents the subsequent NULL pointer dereference that
crashes the kernel when the rebuild does fail.
crash> bt
PID: 50795 TASK: ff34c9ee708dc680 CPU: 1 COMMAND: "kworker/u512:5"
#0 [ff72159bcfe5bb50] machine_kexec at ffffffffaa8850ee
#1 [ff72159bcfe5bba8] __crash_kexec at ffffffffaaa15fba
#2 [ff72159bcfe5bc68] crash_kexec at ffffffffaaa16540
#3 [ff72159bcfe5bc70] oops_end at ffffffffaa837eda
#4 [ff72159bcfe5bc90] page_fault_oops at ffffffffaa893997
#5 [ff72159bcfe5bce8] exc_page_fault at ffffffffab528595
#6 [ff72159bcfe5bd10] asm_exc_page_fault at ffffffffab600bb2
[exception RIP: ice_ena_vf_q_mappings+0x79]
RIP: ffffffffc0a85b29 RSP: ff72159bcfe5bdc8 RFLAGS: 00010206
RAX: 00000000000f0000 RBX: ff34c9efc9c00000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000010 RDI: ff34c9efc9c00000
RBP: ff34c9efc27d4828 R8: 0000000000000093 R9: 0000000000000040
R10: ff34c9efc27d4828 R11: 0000000000000040 R12: 0000000000100000
R13: 0000000000000010 R14: R15:
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
#7 [ff72159bcfe5bdf8] ice_sriov_post_vsi_rebuild at ffffffffc0a85e2e [ice]
#8 [ff72159bcfe5be08] ice_reset_all_vfs at ffffffffc0a920b4 [ice]
#9 [ff72159bcfe5be48] ice_service_task at ffffffffc0a31519 [ice]
#10 [ff72159bcfe5be88] process_one_work at ffffffffaa93dca4
#11 [ff72159bcfe5bec8] worker_thread at ffffffffaa93e9de
#12 [ff72159bcfe5bf18] kthread at ffffffffaa946663
#13 [ff72159bcfe5bf50] ret_from_fork at ffffffffaa8086b9
The panic occurs attempting to dereference the NULL pointer in RDX at
ice_sriov.c:294, which loads vsi->txq_map (offset 0x4b8 in ice_vsi).
The faulting VSI is an allocated slab object but not fully initialized
after a failed ice_vsi_rebuild():
crash> struct ice_vsi 0xff34c9efc27d4828
netdev = 0x0,
rx_rings = 0x0,
tx_rings = 0x0,
q_vectors = 0x0,
txq_map = 0x0,
rxq_map = 0x0,
alloc_txq = 0x10,
num_txq = 0x10,
alloc_rxq = 0x10,
num_rxq = 0x10,
The nvmupdate64e process was performing NVM firmware update:
crash> bt 0xff34c9edd1a30000
PID: 49858 TASK: ff34c9edd1a30000 CPU: 1 COMMAND: "nvmupdate64e"
#0 [ff72159bcd617618] __schedule at ffffffffab5333f8
#4 [ff72159bcd617750] ice_sq_send_cmd at ffffffffc0a35347 [ice]
#5 [ff72159bcd6177a8] ice_sq_send_cmd_retry at ffffffffc0a35b47 [ice]
#6 [ff72159bcd617810] ice_aq_send_cmd at ffffffffc0a38018 [ice]
#7 [ff72159bcd617848] ice_aq_read_nvm at ffffffffc0a40254 [ice]
#8
---truncated---
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 12bb018c538c3b9a050f69f62fa09fa6c9160bca Version: 12bb018c538c3b9a050f69f62fa09fa6c9160bca Version: 12bb018c538c3b9a050f69f62fa09fa6c9160bca Version: 12bb018c538c3b9a050f69f62fa09fa6c9160bca Version: 12bb018c538c3b9a050f69f62fa09fa6c9160bca Version: 12bb018c538c3b9a050f69f62fa09fa6c9160bca |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ice/ice_vf_lib.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "acc76b97902757b63ba5136f787d107647236a19",
"status": "affected",
"version": "12bb018c538c3b9a050f69f62fa09fa6c9160bca",
"versionType": "git"
},
{
"lessThan": "3ad2471e61e9f0c4d25046d08e3d747501c3b0dd",
"status": "affected",
"version": "12bb018c538c3b9a050f69f62fa09fa6c9160bca",
"versionType": "git"
},
{
"lessThan": "4c2ac52eeeb672624b06c7a135301d7b8a21d52e",
"status": "affected",
"version": "12bb018c538c3b9a050f69f62fa09fa6c9160bca",
"versionType": "git"
},
{
"lessThan": "1e9185b13ce57b86844447e092e58abb3be849b1",
"status": "affected",
"version": "12bb018c538c3b9a050f69f62fa09fa6c9160bca",
"versionType": "git"
},
{
"lessThan": "429024f3a407e4137aee825c2a6be0aba857937d",
"status": "affected",
"version": "12bb018c538c3b9a050f69f62fa09fa6c9160bca",
"versionType": "git"
},
{
"lessThan": "54ef02487914c24170c7e1c061e45212dc55365e",
"status": "affected",
"version": "12bb018c538c3b9a050f69f62fa09fa6c9160bca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ice/ice_vf_lib.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix NULL pointer dereference in ice_reset_all_vfs()\n\nice_reset_all_vfs() ignores the return value of ice_vf_rebuild_vsi().\nWhen the VSI rebuild fails (e.g. during NVM firmware update via\nnvmupdate64e), ice_vsi_rebuild() tears down the VSI on its error path,\nleaving txq_map and rxq_map as NULL. The subsequent unconditional call\nto ice_vf_post_vsi_rebuild() leads to a NULL pointer dereference in\nice_ena_vf_q_mappings() when it accesses vsi-\u003etxq_map[0].\n\nThe single-VF reset path in ice_reset_vf() already handles this\ncorrectly by checking the return value of ice_vf_reconfig_vsi() and\nskipping ice_vf_post_vsi_rebuild() on failure.\n\nApply the same pattern to ice_reset_all_vfs(): check the return value\nof ice_vf_rebuild_vsi() and skip ice_vf_post_vsi_rebuild() and\nice_eswitch_attach_vf() on failure. The VF is left safely disabled\n(ICE_VF_STATE_INIT not set, VFGEN_RSTAT not set to VFACTIVE) and can\nbe recovered via a VFLR triggered by a PCI reset of the VF\n(sysfs reset or driver rebind).\n\nNote that this patch does not prevent the VF VSI rebuild from failing\nduring NVM update \u2014 the underlying cause is firmware being in a\ntransitional state while the EMP reset is processed, which can cause\nAdmin Queue commands (ice_add_vsi, ice_cfg_vsi_lan) to fail. This\npatch only prevents the subsequent NULL pointer dereference that\ncrashes the kernel when the rebuild does fail.\n\n crash\u003e bt\n PID: 50795 TASK: ff34c9ee708dc680 CPU: 1 COMMAND: \"kworker/u512:5\"\n #0 [ff72159bcfe5bb50] machine_kexec at ffffffffaa8850ee\n #1 [ff72159bcfe5bba8] __crash_kexec at ffffffffaaa15fba\n #2 [ff72159bcfe5bc68] crash_kexec at ffffffffaaa16540\n #3 [ff72159bcfe5bc70] oops_end at ffffffffaa837eda\n #4 [ff72159bcfe5bc90] page_fault_oops at ffffffffaa893997\n #5 [ff72159bcfe5bce8] exc_page_fault at ffffffffab528595\n #6 [ff72159bcfe5bd10] asm_exc_page_fault at ffffffffab600bb2\n [exception RIP: ice_ena_vf_q_mappings+0x79]\n RIP: ffffffffc0a85b29 RSP: ff72159bcfe5bdc8 RFLAGS: 00010206\n RAX: 00000000000f0000 RBX: ff34c9efc9c00000 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: 0000000000000010 RDI: ff34c9efc9c00000\n RBP: ff34c9efc27d4828 R8: 0000000000000093 R9: 0000000000000040\n R10: ff34c9efc27d4828 R11: 0000000000000040 R12: 0000000000100000\n R13: 0000000000000010 R14: R15:\n ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018\n #7 [ff72159bcfe5bdf8] ice_sriov_post_vsi_rebuild at ffffffffc0a85e2e [ice]\n #8 [ff72159bcfe5be08] ice_reset_all_vfs at ffffffffc0a920b4 [ice]\n #9 [ff72159bcfe5be48] ice_service_task at ffffffffc0a31519 [ice]\n #10 [ff72159bcfe5be88] process_one_work at ffffffffaa93dca4\n #11 [ff72159bcfe5bec8] worker_thread at ffffffffaa93e9de\n #12 [ff72159bcfe5bf18] kthread at ffffffffaa946663\n #13 [ff72159bcfe5bf50] ret_from_fork at ffffffffaa8086b9\n\n The panic occurs attempting to dereference the NULL pointer in RDX at\n ice_sriov.c:294, which loads vsi-\u003etxq_map (offset 0x4b8 in ice_vsi).\n\n The faulting VSI is an allocated slab object but not fully initialized\n after a failed ice_vsi_rebuild():\n\n crash\u003e struct ice_vsi 0xff34c9efc27d4828\n netdev = 0x0,\n rx_rings = 0x0,\n tx_rings = 0x0,\n q_vectors = 0x0,\n txq_map = 0x0,\n rxq_map = 0x0,\n alloc_txq = 0x10,\n num_txq = 0x10,\n alloc_rxq = 0x10,\n num_rxq = 0x10,\n\n The nvmupdate64e process was performing NVM firmware update:\n\n crash\u003e bt 0xff34c9edd1a30000\n PID: 49858 TASK: ff34c9edd1a30000 CPU: 1 COMMAND: \"nvmupdate64e\"\n #0 [ff72159bcd617618] __schedule at ffffffffab5333f8\n #4 [ff72159bcd617750] ice_sq_send_cmd at ffffffffc0a35347 [ice]\n #5 [ff72159bcd6177a8] ice_sq_send_cmd_retry at ffffffffc0a35b47 [ice]\n #6 [ff72159bcd617810] ice_aq_send_cmd at ffffffffc0a38018 [ice]\n #7 [ff72159bcd617848] ice_aq_read_nvm at ffffffffc0a40254 [ice]\n #8 \n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-26T19:40:49.418Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/acc76b97902757b63ba5136f787d107647236a19"
},
{
"url": "https://git.kernel.org/stable/c/3ad2471e61e9f0c4d25046d08e3d747501c3b0dd"
},
{
"url": "https://git.kernel.org/stable/c/4c2ac52eeeb672624b06c7a135301d7b8a21d52e"
},
{
"url": "https://git.kernel.org/stable/c/1e9185b13ce57b86844447e092e58abb3be849b1"
},
{
"url": "https://git.kernel.org/stable/c/429024f3a407e4137aee825c2a6be0aba857937d"
},
{
"url": "https://git.kernel.org/stable/c/54ef02487914c24170c7e1c061e45212dc55365e"
}
],
"title": "ice: fix NULL pointer dereference in ice_reset_all_vfs()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53289",
"datePublished": "2026-06-26T19:40:49.418Z",
"dateReserved": "2026-06-09T07:44:35.396Z",
"dateUpdated": "2026-06-26T19:40:49.418Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53050 (GCVE-0-2026-53050)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
quota: Fix race of dquot_scan_active() with quota deactivation
dquot_scan_active() can race with quota deactivation in
quota_release_workfn() like:
CPU0 (quota_release_workfn) CPU1 (dquot_scan_active)
============================== ==============================
spin_lock(&dq_list_lock);
list_replace_init(
&releasing_dquots, &rls_head);
/* dquot X on rls_head,
dq_count == 0,
DQ_ACTIVE_B still set */
spin_unlock(&dq_list_lock);
synchronize_srcu(&dquot_srcu);
spin_lock(&dq_list_lock);
list_for_each_entry(dquot,
&inuse_list, dq_inuse) {
/* finds dquot X */
dquot_active(X) -> true
atomic_inc(&X->dq_count);
}
spin_unlock(&dq_list_lock);
spin_lock(&dq_list_lock);
dquot = list_first_entry(&rls_head);
WARN_ON_ONCE(atomic_read(&dquot->dq_count));
The problem is not only a cosmetic one as under memory pressure the
caller of dquot_scan_active() can end up working on freed dquot.
Fix the problem by making sure the dquot is removed from releasing list
when we acquire a reference to it.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 22c06bf1f99ec3ec16b1a81342becba4c59a1f16 Version: 56e96b38d2f7cd95b3c30eb70decac7233915e0a Version: 12a820a9923c11e8e898da9f82c8aded70cdcd16 Version: 869b6ea1609f655a43251bf41757aa44e5350a8f Version: 869b6ea1609f655a43251bf41757aa44e5350a8f Version: 869b6ea1609f655a43251bf41757aa44e5350a8f Version: 869b6ea1609f655a43251bf41757aa44e5350a8f Version: 869b6ea1609f655a43251bf41757aa44e5350a8f Version: bb7e3a019b52d829949d02b64ebab37838148fbf Version: 061a18239ced5eb086967a2b4451cb1cc5ce0702 Version: 2a1ddddba6541143c8f73962f3021f1789114284 Version: 5.10.199 ≤ Version: 5.15.136 ≤ Version: 6.1.59 ≤ Version: 4.19.297 ≤ Version: 5.4.259 ≤ Version: 6.5.8 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/quota/dquot.c",
"include/linux/quotaops.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2bdc80f4619411e5bd4a3ef23f51e14021ed457c",
"status": "affected",
"version": "22c06bf1f99ec3ec16b1a81342becba4c59a1f16",
"versionType": "git"
},
{
"lessThan": "f9438cb8c8ec3adc84b2b450a3aab0123d074c3b",
"status": "affected",
"version": "56e96b38d2f7cd95b3c30eb70decac7233915e0a",
"versionType": "git"
},
{
"lessThan": "ac8a2e0d287ebf35e5d7e51e260b4e146648ba4a",
"status": "affected",
"version": "12a820a9923c11e8e898da9f82c8aded70cdcd16",
"versionType": "git"
},
{
"lessThan": "6678dde265708003c2b42551af4a2e3cb05decd5",
"status": "affected",
"version": "869b6ea1609f655a43251bf41757aa44e5350a8f",
"versionType": "git"
},
{
"lessThan": "61e25f664dc2a08299e07d84c85776abc2350f75",
"status": "affected",
"version": "869b6ea1609f655a43251bf41757aa44e5350a8f",
"versionType": "git"
},
{
"lessThan": "fdd424d7c35633ac577fd87d1b043d1b8a6cd350",
"status": "affected",
"version": "869b6ea1609f655a43251bf41757aa44e5350a8f",
"versionType": "git"
},
{
"lessThan": "82cbdb4c1ebb5ea7d7bd45c18d3483b5bd32ebc1",
"status": "affected",
"version": "869b6ea1609f655a43251bf41757aa44e5350a8f",
"versionType": "git"
},
{
"lessThan": "e93ab401da4b2e2c1b8ef2424de2f238d51c8b2d",
"status": "affected",
"version": "869b6ea1609f655a43251bf41757aa44e5350a8f",
"versionType": "git"
},
{
"status": "affected",
"version": "bb7e3a019b52d829949d02b64ebab37838148fbf",
"versionType": "git"
},
{
"status": "affected",
"version": "061a18239ced5eb086967a2b4451cb1cc5ce0702",
"versionType": "git"
},
{
"status": "affected",
"version": "2a1ddddba6541143c8f73962f3021f1789114284",
"versionType": "git"
},
{
"lessThan": "5.10.258",
"status": "affected",
"version": "5.10.199",
"versionType": "semver"
},
{
"lessThan": "5.15.209",
"status": "affected",
"version": "5.15.136",
"versionType": "semver"
},
{
"lessThan": "6.1.175",
"status": "affected",
"version": "6.1.59",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.297",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.259",
"versionType": "semver"
},
{
"lessThan": "6.6",
"status": "affected",
"version": "6.5.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/quota/dquot.c",
"include/linux/quotaops.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.10.199",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.15.136",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1.59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.297",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.259",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nquota: Fix race of dquot_scan_active() with quota deactivation\n\ndquot_scan_active() can race with quota deactivation in\nquota_release_workfn() like:\n\n CPU0 (quota_release_workfn) CPU1 (dquot_scan_active)\n ============================== ==============================\n spin_lock(\u0026dq_list_lock);\n list_replace_init(\n \u0026releasing_dquots, \u0026rls_head);\n /* dquot X on rls_head,\n dq_count == 0,\n DQ_ACTIVE_B still set */\n spin_unlock(\u0026dq_list_lock);\n synchronize_srcu(\u0026dquot_srcu);\n spin_lock(\u0026dq_list_lock);\n list_for_each_entry(dquot,\n \u0026inuse_list, dq_inuse) {\n /* finds dquot X */\n dquot_active(X) -\u003e true\n atomic_inc(\u0026X-\u003edq_count);\n }\n spin_unlock(\u0026dq_list_lock);\n spin_lock(\u0026dq_list_lock);\n dquot = list_first_entry(\u0026rls_head);\n WARN_ON_ONCE(atomic_read(\u0026dquot-\u003edq_count));\n\nThe problem is not only a cosmetic one as under memory pressure the\ncaller of dquot_scan_active() can end up working on freed dquot.\n\nFix the problem by making sure the dquot is removed from releasing list\nwhen we acquire a reference to it."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local filesystem quota activity on a mounted OCFS2 filesystem, via ordinary dquot lifetime changes racing with the OCFS2 quota sync worker. It is not reachable by remote packets or adjacent/physical input.\nAC:L - This is a race, but a local attacker can repeatedly churn dquot references with filesystem operations while the periodic scanner runs. When uncertain, the higher-severity AC:L is appropriate.\nPR:L - After OCFS2 quotas are enabled, an unprivileged local user with write access to the filesystem can trigger dquot allocation and release paths. Mounting/configuring quotas is an environmental prerequisite, not a privilege needed for each exploit attempt.\nUI:N - No victim interaction is required once the affected filesystem is mounted and quotas are active. The attacker can trigger the relevant filesystem operations directly.\nS:U - The impact remains within the kernel and the same host security authority. There is no VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The bug can lead to use-after-free of a dquot object under memory pressure. Kernel UAF conditions can be leveraged for memory disclosure, so confidentiality impact is High.\nI:H - The stale dquot/list state creates kernel heap use-after-free/list corruption, which can plausibly be shaped into write primitives or code execution. Integrity impact is therefore High.\nA:H - The race already produces kernel WARN/oops-style failure conditions and can dereference freed kernel objects. This can crash or destabilize the kernel, so availability impact is High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:56.160Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2bdc80f4619411e5bd4a3ef23f51e14021ed457c"
},
{
"url": "https://git.kernel.org/stable/c/f9438cb8c8ec3adc84b2b450a3aab0123d074c3b"
},
{
"url": "https://git.kernel.org/stable/c/ac8a2e0d287ebf35e5d7e51e260b4e146648ba4a"
},
{
"url": "https://git.kernel.org/stable/c/6678dde265708003c2b42551af4a2e3cb05decd5"
},
{
"url": "https://git.kernel.org/stable/c/61e25f664dc2a08299e07d84c85776abc2350f75"
},
{
"url": "https://git.kernel.org/stable/c/fdd424d7c35633ac577fd87d1b043d1b8a6cd350"
},
{
"url": "https://git.kernel.org/stable/c/82cbdb4c1ebb5ea7d7bd45c18d3483b5bd32ebc1"
},
{
"url": "https://git.kernel.org/stable/c/e93ab401da4b2e2c1b8ef2424de2f238d51c8b2d"
}
],
"title": "quota: Fix race of dquot_scan_active() with quota deactivation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53050",
"datePublished": "2026-06-24T16:29:56.043Z",
"dateReserved": "2026-06-09T07:44:35.381Z",
"dateUpdated": "2026-08-05T12:32:56.160Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53329 (GCVE-0-2026-53329)
Vulnerability from cvelistv5
Published
2026-07-01 13:32
Modified
2026-08-05 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Use krealloc_array() in dal_vector_reserve()
[Why & How]
dal_vector_reserve() computes the allocation size as
"capacity * vector->struct_size" using uint32_t arithmetic, which can
silently wrap to a small value on overflow. This would cause krealloc to
return a smaller buffer than expected, leading to heap overflows on
subsequent vector appends.
Replace krealloc() with krealloc_array() which performs an internal
overflow check and returns NULL on wrap, preventing the issue.
(cherry picked from commit 37668568641ccc4cc1dbca4923d0a16609dd5707)
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2004f45ef83f07f43f5da6ede780b08068c7583d Version: 2004f45ef83f07f43f5da6ede780b08068c7583d Version: 2004f45ef83f07f43f5da6ede780b08068c7583d Version: 2004f45ef83f07f43f5da6ede780b08068c7583d Version: 2004f45ef83f07f43f5da6ede780b08068c7583d Version: 2004f45ef83f07f43f5da6ede780b08068c7583d Version: 2004f45ef83f07f43f5da6ede780b08068c7583d Version: 2004f45ef83f07f43f5da6ede780b08068c7583d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/basics/vector.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9540b0a4d13e4ede64ae1197d66a176d2149daa9",
"status": "affected",
"version": "2004f45ef83f07f43f5da6ede780b08068c7583d",
"versionType": "git"
},
{
"lessThan": "31180638a33acad12c863132704a76536fb66211",
"status": "affected",
"version": "2004f45ef83f07f43f5da6ede780b08068c7583d",
"versionType": "git"
},
{
"lessThan": "b15825deac1acff72638bbc8f05b89ceef8dfb13",
"status": "affected",
"version": "2004f45ef83f07f43f5da6ede780b08068c7583d",
"versionType": "git"
},
{
"lessThan": "201151e120f0062bcda21cad5d007b82725ad23b",
"status": "affected",
"version": "2004f45ef83f07f43f5da6ede780b08068c7583d",
"versionType": "git"
},
{
"lessThan": "a914aa802669e073f014dae2e5708633b5cecd34",
"status": "affected",
"version": "2004f45ef83f07f43f5da6ede780b08068c7583d",
"versionType": "git"
},
{
"lessThan": "e09689286385a66311ac6922af95339d7a3cef8d",
"status": "affected",
"version": "2004f45ef83f07f43f5da6ede780b08068c7583d",
"versionType": "git"
},
{
"lessThan": "de988c7a31f0774f07894cfe4802996f318e2870",
"status": "affected",
"version": "2004f45ef83f07f43f5da6ede780b08068c7583d",
"versionType": "git"
},
{
"lessThan": "da48bc4461b8a5ebfb9264c9b191a701d8e99009",
"status": "affected",
"version": "2004f45ef83f07f43f5da6ede780b08068c7583d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/basics/vector.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Use krealloc_array() in dal_vector_reserve()\n\n[Why \u0026 How]\ndal_vector_reserve() computes the allocation size as\n\"capacity * vector-\u003estruct_size\" using uint32_t arithmetic, which can\nsilently wrap to a small value on overflow. This would cause krealloc to\nreturn a smaller buffer than expected, leading to heap overflows on\nsubsequent vector appends.\n\nReplace krealloc() with krealloc_array() which performs an internal\noverflow check and returns NULL on wrap, preventing the issue.\n\n(cherry picked from commit 37668568641ccc4cc1dbca4923d0a16609dd5707)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The reachable kernel path is AMDGPU DRM display handling via local DRM connector probing or modeset operations; it is not network or namespace reachable. Physical hotplug can also reach related detection paths, but local DRM access is the higher-severity reasonable vector.\nAC:H - The overflow is deterministic once vector capacity crosses the uint32 multiplication limit, but the reachable DDC callers I found pass fixed tiny payload lengths and an attacker would need an unusual path causing enormous vector growth. That prerequisite is outside normal attacker control.\nPR:L - Triggering the relevant DRM display paths requires local access to the KMS device or DRM master-style display control, not real root in the init namespace. No user-namespace route or network-facing unauthenticated path reaches this code.\nUI:N - A local attacker who has the needed DRM access can trigger connector probing or modeset paths directly. No separate victim action is required.\nS:U - The corruption occurs inside the host kernel display driver and affects the same kernel security authority. There is no VM escape, IOMMU boundary bypass, or cross-scope component involved.\nC:H - The vulnerable allocation can leave the vector with a logical capacity larger than its actual heap buffer, and subsequent appends can corrupt adjacent kernel heap memory. Kernel heap corruption is reasonably leverageable for information disclosure.\nI:H - Subsequent vector appends perform out-of-bounds writes of controlled `struct i2c_payload` contents into adjacent kernel heap memory. That is kernel memory corruption and can plausibly support control-flow or data-integrity compromise.\nA:H - Even without full exploitation, the undersized allocation followed by appends can corrupt heap metadata or neighboring objects. That can cause kernel oops, panic, or display-driver crashes."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:35:01.324Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9540b0a4d13e4ede64ae1197d66a176d2149daa9"
},
{
"url": "https://git.kernel.org/stable/c/31180638a33acad12c863132704a76536fb66211"
},
{
"url": "https://git.kernel.org/stable/c/b15825deac1acff72638bbc8f05b89ceef8dfb13"
},
{
"url": "https://git.kernel.org/stable/c/201151e120f0062bcda21cad5d007b82725ad23b"
},
{
"url": "https://git.kernel.org/stable/c/a914aa802669e073f014dae2e5708633b5cecd34"
},
{
"url": "https://git.kernel.org/stable/c/e09689286385a66311ac6922af95339d7a3cef8d"
},
{
"url": "https://git.kernel.org/stable/c/de988c7a31f0774f07894cfe4802996f318e2870"
},
{
"url": "https://git.kernel.org/stable/c/da48bc4461b8a5ebfb9264c9b191a701d8e99009"
}
],
"title": "drm/amd/display: Use krealloc_array() in dal_vector_reserve()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53329",
"datePublished": "2026-07-01T13:32:14.598Z",
"dateReserved": "2026-06-09T07:44:35.398Z",
"dateUpdated": "2026-08-05T12:35:01.324Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53006 (GCVE-0-2026-53006)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix possible UAF in icmpv6_rcv()
Caching saddr and daddr before pskb_pull() is problematic
since skb->head can change.
Remove these temporary variables:
- We only access &ipv6_hdr(skb)->saddr and &ipv6_hdr(skb)->daddr
when net_dbg_ratelimited() is called in the slow path.
- Avoid potential future misuse after pskb_pull() call.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4b3418fba0fe819197e3359d5ddbef84ba2c59de Version: 4b3418fba0fe819197e3359d5ddbef84ba2c59de Version: 4b3418fba0fe819197e3359d5ddbef84ba2c59de Version: 4b3418fba0fe819197e3359d5ddbef84ba2c59de Version: 4b3418fba0fe819197e3359d5ddbef84ba2c59de Version: 4b3418fba0fe819197e3359d5ddbef84ba2c59de Version: 4b3418fba0fe819197e3359d5ddbef84ba2c59de Version: 4b3418fba0fe819197e3359d5ddbef84ba2c59de |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.40.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.148.1.rt7.489.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.148.1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.30.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s IPv6 (Internet Protocol version 6) implementation. This vulnerability, a Use-After-Free (UAF) error, occurs due to incorrect caching of network packet addresses before a memory operation. An attacker could potentially exploit this flaw to cause memory corruption, which may lead to a denial of service or, in some scenarios, arbitrary code execution."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-825",
"description": "Expired Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:04:41.905Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-53006"
},
{
"name": "RHBZ#2492363",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492363"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53006.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47017"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:45192"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47011"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47010"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:47017: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:45192: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:47011: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:47010: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: ipv6: fix possible UAF in icmpv6_rcv()",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/icmp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7bff2c8fe5c35ae58bf73104f53db3676e6e5d94",
"status": "affected",
"version": "4b3418fba0fe819197e3359d5ddbef84ba2c59de",
"versionType": "git"
},
{
"lessThan": "aff0f28f5be803de2452ce702631c021fcd9ce8a",
"status": "affected",
"version": "4b3418fba0fe819197e3359d5ddbef84ba2c59de",
"versionType": "git"
},
{
"lessThan": "38bdbc897c0d83a3e2b925a51b69420f1feba29a",
"status": "affected",
"version": "4b3418fba0fe819197e3359d5ddbef84ba2c59de",
"versionType": "git"
},
{
"lessThan": "0069813e6ca9309eca78022bcb3aeb1e9ef90a12",
"status": "affected",
"version": "4b3418fba0fe819197e3359d5ddbef84ba2c59de",
"versionType": "git"
},
{
"lessThan": "1e1f0f89ee4692a64be3f3707ff8ac1ae57b03e7",
"status": "affected",
"version": "4b3418fba0fe819197e3359d5ddbef84ba2c59de",
"versionType": "git"
},
{
"lessThan": "7c66b368c6ff453f99cb39d84af93e908e51eef2",
"status": "affected",
"version": "4b3418fba0fe819197e3359d5ddbef84ba2c59de",
"versionType": "git"
},
{
"lessThan": "085e31a811ef234ef8c3e219c4636dfebfe7e10f",
"status": "affected",
"version": "4b3418fba0fe819197e3359d5ddbef84ba2c59de",
"versionType": "git"
},
{
"lessThan": "f996edd7615e686ada141b7f3395025729ff8ccb",
"status": "affected",
"version": "4b3418fba0fe819197e3359d5ddbef84ba2c59de",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/icmp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix possible UAF in icmpv6_rcv()\n\nCaching saddr and daddr before pskb_pull() is problematic\nsince skb-\u003ehead can change.\n\nRemove these temporary variables:\n\n- We only access \u0026ipv6_hdr(skb)-\u003esaddr and \u0026ipv6_hdr(skb)-\u003edaddr\n when net_dbg_ratelimited() is called in the slow path.\n\n- Avoid potential future misuse after pskb_pull() call."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - icmpv6_rcv() is reached by inbound IPv6 ICMPv6 packets through the normal network receive path. A remote IPv6 peer can send crafted ICMPv6 packets to a reachable host without local access.\nAC:L - The attacker can craft the ICMPv6 type, checksum, and fragmentation/non-linear skb layout needed to reach the stale-pointer path after pskb_pull(). There is no attacker-uncontrolled race required.\nPR:N - Inbound ICMPv6 processing occurs before any user authentication or privilege check. No local account or kernel capability is required to send the triggering packets.\nUI:N - No victim user action is required. The kernel processes the packets automatically on receive.\nS:U - The impact is within the vulnerable kernel/network stack security authority. This is not a guest-to-host escape or other cross-scope boundary bypass.\nC:H - The bug is a use-after-free of IPv6 address pointers into skb-\u003ehead after pskb_pull() can reallocate and free that buffer. Under the required conservative kernel guidance, UAF is treated as high confidentiality impact due potential freed-kernel-memory disclosure.\nI:H - This is a kernel heap use-after-free in a remote packet-processing path. Under the required conservative kernel guidance, UAF is treated as high integrity impact because heap reuse/spraying can make UAFs exploitable beyond the immediate stale read.\nA:H - A remotely triggerable kernel UAF can produce an oops/panic or repeated fault, especially in debug/KASAN or hardened deployments. Repeated crafted packets can therefore cause high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:35.427Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7bff2c8fe5c35ae58bf73104f53db3676e6e5d94"
},
{
"url": "https://git.kernel.org/stable/c/aff0f28f5be803de2452ce702631c021fcd9ce8a"
},
{
"url": "https://git.kernel.org/stable/c/38bdbc897c0d83a3e2b925a51b69420f1feba29a"
},
{
"url": "https://git.kernel.org/stable/c/0069813e6ca9309eca78022bcb3aeb1e9ef90a12"
},
{
"url": "https://git.kernel.org/stable/c/1e1f0f89ee4692a64be3f3707ff8ac1ae57b03e7"
},
{
"url": "https://git.kernel.org/stable/c/7c66b368c6ff453f99cb39d84af93e908e51eef2"
},
{
"url": "https://git.kernel.org/stable/c/085e31a811ef234ef8c3e219c4636dfebfe7e10f"
},
{
"url": "https://git.kernel.org/stable/c/f996edd7615e686ada141b7f3395025729ff8ccb"
}
],
"title": "ipv6: fix possible UAF in icmpv6_rcv()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53006",
"datePublished": "2026-06-24T16:29:17.691Z",
"dateReserved": "2026-06-09T07:44:35.377Z",
"dateUpdated": "2026-08-05T12:32:35.427Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53036 (GCVE-0-2026-53036)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf, arm64: Fix off-by-one in check_imm signed range check
check_imm(bits, imm) is used in the arm64 BPF JIT to verify that
a branch displacement (in arm64 instruction units) fits into the
signed N-bit immediate field of a B, B.cond or CBZ/CBNZ encoding
before it is handed to the encoder. The macro currently tests for
(imm > 0 && imm >> bits) || (imm < 0 && ~imm >> bits) which admits
values in [-2^N, 2^N) — effectively a signed (N+1)-bit range. A
signed N-bit field only holds [-2^(N-1), 2^(N-1)), so the check
admits one extra bit of range on each side.
In particular, for check_imm19(), values in [2^18, 2^19) slip past
the check but do not fit into the 19-bit signed imm19 field of
B.cond. aarch64_insn_encode_immediate() then masks the raw value
into the 19-bit field, setting bit 18 (the sign bit) and flipping
a forward branch into a backward one. Same class of issue exists
for check_imm26() and the B/BL encoding. Shift by (bits - 1)
instead of bits so the actual signed N-bit range is enforced.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e54bcde3d69d40023ae77727213d14f920eb264a Version: e54bcde3d69d40023ae77727213d14f920eb264a Version: e54bcde3d69d40023ae77727213d14f920eb264a Version: e54bcde3d69d40023ae77727213d14f920eb264a Version: e54bcde3d69d40023ae77727213d14f920eb264a Version: e54bcde3d69d40023ae77727213d14f920eb264a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/net/bpf_jit_comp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a5dfeb3b61065039488342d43ae06d4729d955d4",
"status": "affected",
"version": "e54bcde3d69d40023ae77727213d14f920eb264a",
"versionType": "git"
},
{
"lessThan": "7fd3b41260c6120e7b60164afea5d961af6224f9",
"status": "affected",
"version": "e54bcde3d69d40023ae77727213d14f920eb264a",
"versionType": "git"
},
{
"lessThan": "6927f0d6794aa73318bbfa929f1ff6065b0620df",
"status": "affected",
"version": "e54bcde3d69d40023ae77727213d14f920eb264a",
"versionType": "git"
},
{
"lessThan": "1a113b5497297871699cd498b1b83542e0db7f15",
"status": "affected",
"version": "e54bcde3d69d40023ae77727213d14f920eb264a",
"versionType": "git"
},
{
"lessThan": "fb74defa1cca1a73177c0c761e641332e4f979a3",
"status": "affected",
"version": "e54bcde3d69d40023ae77727213d14f920eb264a",
"versionType": "git"
},
{
"lessThan": "1dd8be4ec722ce54e4cace59f3a4ba658111b3ec",
"status": "affected",
"version": "e54bcde3d69d40023ae77727213d14f920eb264a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/net/bpf_jit_comp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.18"
},
{
"lessThan": "3.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, arm64: Fix off-by-one in check_imm signed range check\n\ncheck_imm(bits, imm) is used in the arm64 BPF JIT to verify that\na branch displacement (in arm64 instruction units) fits into the\nsigned N-bit immediate field of a B, B.cond or CBZ/CBNZ encoding\nbefore it is handed to the encoder. The macro currently tests for\n(imm \u003e 0 \u0026\u0026 imm \u003e\u003e bits) || (imm \u003c 0 \u0026\u0026 ~imm \u003e\u003e bits) which admits\nvalues in [-2^N, 2^N) \u2014 effectively a signed (N+1)-bit range. A\nsigned N-bit field only holds [-2^(N-1), 2^(N-1)), so the check\nadmits one extra bit of range on each side.\n\nIn particular, for check_imm19(), values in [2^18, 2^19) slip past\nthe check but do not fit into the 19-bit signed imm19 field of\nB.cond. aarch64_insn_encode_immediate() then masks the raw value\ninto the 19-bit field, setting bit 18 (the sign bit) and flipping\na forward branch into a backward one. Same class of issue exists\nfor check_imm26() and the B/BL encoding. Shift by (bits - 1)\ninstead of bits so the actual signed N-bit range is enforced."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable arm64 BPF JIT code is reached by a local attacker through the bpf() syscall with BPF_PROG_LOAD, not by remote packets or adjacent/physical access.\nAC:L - Triggering is deterministic once the attacker can load a suitably large BPF program on an arm64 kernel with BPF JIT enabled; there is no race or victim state dependency.\nPR:L - The oversized program needed to hit the bad immediate range requires privileged BPF loading, but BPF tokens/namespaced delegation make this reachable with non-host-root delegated privileges in plausible deployments. Under the required uncertainty rule, PR:L is the higher-severity defensible choice over PR:H.\nUI:N - No victim action is required after the attacker submits and runs the crafted BPF program.\nS:U - The vulnerability affects kernel execution within the same host security authority and is a standard local kernel compromise path, not a VM/container boundary escape by itself.\nC:H - The JIT can emit a verifier-unmodeled branch into attacker-shaped native BPF code, a BPF JIT verifier-bypass class issue that can plausibly yield arbitrary kernel memory read.\nI:H - The miscompiled branch can redirect execution through unintended JIT code paths, making arbitrary kernel code execution or write primitives defensible.\nA:H - Even without full exploitation, the invalid native control flow can reliably crash or hang kernel execution when the malformed BPF program runs."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:47.252Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a5dfeb3b61065039488342d43ae06d4729d955d4"
},
{
"url": "https://git.kernel.org/stable/c/7fd3b41260c6120e7b60164afea5d961af6224f9"
},
{
"url": "https://git.kernel.org/stable/c/6927f0d6794aa73318bbfa929f1ff6065b0620df"
},
{
"url": "https://git.kernel.org/stable/c/1a113b5497297871699cd498b1b83542e0db7f15"
},
{
"url": "https://git.kernel.org/stable/c/fb74defa1cca1a73177c0c761e641332e4f979a3"
},
{
"url": "https://git.kernel.org/stable/c/1dd8be4ec722ce54e4cace59f3a4ba658111b3ec"
}
],
"title": "bpf, arm64: Fix off-by-one in check_imm signed range check",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53036",
"datePublished": "2026-06-24T16:29:43.449Z",
"dateReserved": "2026-06-09T07:44:35.380Z",
"dateUpdated": "2026-08-05T12:32:47.252Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53112 (GCVE-0-2026-53112)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-06-24 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet
The irq_prepare_bcn_tasklet is initialized in rtl_pci_init() and
scheduled when RTL_IMR_BCNINT interrupt is triggered by hardware.
But it is never killed in rtl_pci_deinit(). When the rtlwifi card
probe fails or is being detached, the ieee80211_hw is deallocated.
However, irq_prepare_bcn_tasklet may still be running or pending,
leading to use-after-free when the freed ieee80211_hw is accessed
in _rtl_pci_prepare_bcn_tasklet().
Similar to irq_tasklet, add tasklet_kill() in rtl_pci_deinit() to
ensure that irq_prepare_bcn_tasklet is properly terminated before
the ieee80211_hw is released.
The issue was identified through static analysis.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0c8173385e549f95cd80c3fff5aab87b4f881d8d Version: 0c8173385e549f95cd80c3fff5aab87b4f881d8d Version: 0c8173385e549f95cd80c3fff5aab87b4f881d8d Version: 0c8173385e549f95cd80c3fff5aab87b4f881d8d Version: 0c8173385e549f95cd80c3fff5aab87b4f881d8d Version: 0c8173385e549f95cd80c3fff5aab87b4f881d8d Version: 0c8173385e549f95cd80c3fff5aab87b4f881d8d Version: 0c8173385e549f95cd80c3fff5aab87b4f881d8d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/realtek/rtlwifi/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ae10d4a1ab6bcaa1336abb171908a9a365761d3e",
"status": "affected",
"version": "0c8173385e549f95cd80c3fff5aab87b4f881d8d",
"versionType": "git"
},
{
"lessThan": "fac1079e0fdec6df6d7562c21941587236dc3def",
"status": "affected",
"version": "0c8173385e549f95cd80c3fff5aab87b4f881d8d",
"versionType": "git"
},
{
"lessThan": "e40873820c9d245ce482faa7ad514ebdb3b8d23d",
"status": "affected",
"version": "0c8173385e549f95cd80c3fff5aab87b4f881d8d",
"versionType": "git"
},
{
"lessThan": "008c456b76e9070979bc0e763897a5d3b0fdd4dc",
"status": "affected",
"version": "0c8173385e549f95cd80c3fff5aab87b4f881d8d",
"versionType": "git"
},
{
"lessThan": "7731b67bd59d1284d150cbe40a47e95a10613234",
"status": "affected",
"version": "0c8173385e549f95cd80c3fff5aab87b4f881d8d",
"versionType": "git"
},
{
"lessThan": "aa10a452e34810987fb9f4a047995b30003fb53f",
"status": "affected",
"version": "0c8173385e549f95cd80c3fff5aab87b4f881d8d",
"versionType": "git"
},
{
"lessThan": "3c0e8a3179e6325a7dc6ce221aef0e03d854ab4b",
"status": "affected",
"version": "0c8173385e549f95cd80c3fff5aab87b4f881d8d",
"versionType": "git"
},
{
"lessThan": "039cd522dc70151da13329a5e3ae19b1736f468a",
"status": "affected",
"version": "0c8173385e549f95cd80c3fff5aab87b4f881d8d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/realtek/rtlwifi/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.38"
},
{
"lessThan": "2.6.38",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.38",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet\n\nThe irq_prepare_bcn_tasklet is initialized in rtl_pci_init() and\nscheduled when RTL_IMR_BCNINT interrupt is triggered by hardware.\nBut it is never killed in rtl_pci_deinit(). When the rtlwifi card\nprobe fails or is being detached, the ieee80211_hw is deallocated.\nHowever, irq_prepare_bcn_tasklet may still be running or pending,\nleading to use-after-free when the freed ieee80211_hw is accessed\nin _rtl_pci_prepare_bcn_tasklet().\n\nSimilar to irq_tasklet, add tasklet_kill() in rtl_pci_deinit() to\nensure that irq_prepare_bcn_tasklet is properly terminated before\nthe ieee80211_hw is released.\n\nThe issue was identified through static analysis."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:45.359Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ae10d4a1ab6bcaa1336abb171908a9a365761d3e"
},
{
"url": "https://git.kernel.org/stable/c/fac1079e0fdec6df6d7562c21941587236dc3def"
},
{
"url": "https://git.kernel.org/stable/c/e40873820c9d245ce482faa7ad514ebdb3b8d23d"
},
{
"url": "https://git.kernel.org/stable/c/008c456b76e9070979bc0e763897a5d3b0fdd4dc"
},
{
"url": "https://git.kernel.org/stable/c/7731b67bd59d1284d150cbe40a47e95a10613234"
},
{
"url": "https://git.kernel.org/stable/c/aa10a452e34810987fb9f4a047995b30003fb53f"
},
{
"url": "https://git.kernel.org/stable/c/3c0e8a3179e6325a7dc6ce221aef0e03d854ab4b"
},
{
"url": "https://git.kernel.org/stable/c/039cd522dc70151da13329a5e3ae19b1736f468a"
}
],
"title": "wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53112",
"datePublished": "2026-06-24T16:30:45.359Z",
"dateReserved": "2026-06-09T07:44:35.385Z",
"dateUpdated": "2026-06-24T16:30:45.359Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53035 (GCVE-0-2026-53035)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-06-24 16:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: Fix af_unix iter deadlock
bpf_iter_unix_seq_show() may deadlock when lock_sock_fast() takes the fast
path and the iter prog attempts to update a sockmap. Which ends up spinning
at sock_map_update_elem()'s bh_lock_sock():
WARNING: possible recursive locking detected
test_progs/1393 is trying to acquire lock:
ffff88811ec25f58 (slock-AF_UNIX){+...}-{3:3}, at: sock_map_update_elem+0xdb/0x1f0
but task is already holding lock:
ffff88811ec25f58 (slock-AF_UNIX){+...}-{3:3}, at: __lock_sock_fast+0x37/0xe0
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(slock-AF_UNIX);
lock(slock-AF_UNIX);
*** DEADLOCK ***
May be due to missing lock nesting notation
4 locks held by test_progs/1393:
#0: ffff88814b59c790 (&p->lock){+.+.}-{4:4}, at: bpf_seq_read+0x59/0x10d0
#1: ffff88811ec25fd8 (sk_lock-AF_UNIX){+.+.}-{0:0}, at: bpf_seq_read+0x42c/0x10d0
#2: ffff88811ec25f58 (slock-AF_UNIX){+...}-{3:3}, at: __lock_sock_fast+0x37/0xe0
#3: ffffffff85a6a7c0 (rcu_read_lock){....}-{1:3}, at: bpf_iter_run_prog+0x51d/0xb00
Call Trace:
dump_stack_lvl+0x5d/0x80
print_deadlock_bug.cold+0xc0/0xce
__lock_acquire+0x130f/0x2590
lock_acquire+0x14e/0x2b0
_raw_spin_lock+0x30/0x40
sock_map_update_elem+0xdb/0x1f0
bpf_prog_2d0075e5d9b721cd_dump_unix+0x55/0x4f4
bpf_iter_run_prog+0x5b9/0xb00
bpf_iter_unix_seq_show+0x1f7/0x2e0
bpf_seq_read+0x42c/0x10d0
vfs_read+0x171/0xb20
ksys_read+0xff/0x200
do_syscall_64+0x6b/0x3a0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2c860a43dd77f969bb959336a2f743d7103a8f63 Version: 2c860a43dd77f969bb959336a2f743d7103a8f63 Version: 2c860a43dd77f969bb959336a2f743d7103a8f63 Version: 2c860a43dd77f969bb959336a2f743d7103a8f63 Version: 2c860a43dd77f969bb959336a2f743d7103a8f63 Version: 2c860a43dd77f969bb959336a2f743d7103a8f63 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/unix/af_unix.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bd3592129f24243713673a07225cf1f15a9bb835",
"status": "affected",
"version": "2c860a43dd77f969bb959336a2f743d7103a8f63",
"versionType": "git"
},
{
"lessThan": "3cef33b9813b78f227942572fb317afcd5c9ac94",
"status": "affected",
"version": "2c860a43dd77f969bb959336a2f743d7103a8f63",
"versionType": "git"
},
{
"lessThan": "87828b380956d4986f59f2c086e0b09b3e6cdaae",
"status": "affected",
"version": "2c860a43dd77f969bb959336a2f743d7103a8f63",
"versionType": "git"
},
{
"lessThan": "527057ebe8076dfbcaef51195ff1b7508646be2c",
"status": "affected",
"version": "2c860a43dd77f969bb959336a2f743d7103a8f63",
"versionType": "git"
},
{
"lessThan": "66d9fab4565eafe1afe7ba0581f79b76073b60fa",
"status": "affected",
"version": "2c860a43dd77f969bb959336a2f743d7103a8f63",
"versionType": "git"
},
{
"lessThan": "4d328dd695383224aa750ddee6b4ad40c0f8d205",
"status": "affected",
"version": "2c860a43dd77f969bb959336a2f743d7103a8f63",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/unix/af_unix.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix af_unix iter deadlock\n\nbpf_iter_unix_seq_show() may deadlock when lock_sock_fast() takes the fast\npath and the iter prog attempts to update a sockmap. Which ends up spinning\nat sock_map_update_elem()\u0027s bh_lock_sock():\n\nWARNING: possible recursive locking detected\ntest_progs/1393 is trying to acquire lock:\nffff88811ec25f58 (slock-AF_UNIX){+...}-{3:3}, at: sock_map_update_elem+0xdb/0x1f0\n\nbut task is already holding lock:\nffff88811ec25f58 (slock-AF_UNIX){+...}-{3:3}, at: __lock_sock_fast+0x37/0xe0\n\nother info that might help us debug this:\n Possible unsafe locking scenario:\n\n CPU0\n ----\n lock(slock-AF_UNIX);\n lock(slock-AF_UNIX);\n\n *** DEADLOCK ***\n\n May be due to missing lock nesting notation\n\n4 locks held by test_progs/1393:\n #0: ffff88814b59c790 (\u0026p-\u003elock){+.+.}-{4:4}, at: bpf_seq_read+0x59/0x10d0\n #1: ffff88811ec25fd8 (sk_lock-AF_UNIX){+.+.}-{0:0}, at: bpf_seq_read+0x42c/0x10d0\n #2: ffff88811ec25f58 (slock-AF_UNIX){+...}-{3:3}, at: __lock_sock_fast+0x37/0xe0\n #3: ffffffff85a6a7c0 (rcu_read_lock){....}-{1:3}, at: bpf_iter_run_prog+0x51d/0xb00\n\nCall Trace:\n dump_stack_lvl+0x5d/0x80\n print_deadlock_bug.cold+0xc0/0xce\n __lock_acquire+0x130f/0x2590\n lock_acquire+0x14e/0x2b0\n _raw_spin_lock+0x30/0x40\n sock_map_update_elem+0xdb/0x1f0\n bpf_prog_2d0075e5d9b721cd_dump_unix+0x55/0x4f4\n bpf_iter_run_prog+0x5b9/0xb00\n bpf_iter_unix_seq_show+0x1f7/0x2e0\n bpf_seq_read+0x42c/0x10d0\n vfs_read+0x171/0xb20\n ksys_read+0xff/0x200\n do_syscall_64+0x6b/0x3a0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:29:42.560Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bd3592129f24243713673a07225cf1f15a9bb835"
},
{
"url": "https://git.kernel.org/stable/c/3cef33b9813b78f227942572fb317afcd5c9ac94"
},
{
"url": "https://git.kernel.org/stable/c/87828b380956d4986f59f2c086e0b09b3e6cdaae"
},
{
"url": "https://git.kernel.org/stable/c/527057ebe8076dfbcaef51195ff1b7508646be2c"
},
{
"url": "https://git.kernel.org/stable/c/66d9fab4565eafe1afe7ba0581f79b76073b60fa"
},
{
"url": "https://git.kernel.org/stable/c/4d328dd695383224aa750ddee6b4ad40c0f8d205"
}
],
"title": "bpf, sockmap: Fix af_unix iter deadlock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53035",
"datePublished": "2026-06-24T16:29:42.560Z",
"dateReserved": "2026-06-09T07:44:35.380Z",
"dateUpdated": "2026-06-24T16:29:42.560Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…